11241100x8000000000000000242055Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:47.881{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242054Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:47.880{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E48767D89A9FFEB380D9CC714C390BFE,SHA256=33C71EFBA7ED6159BFF487C27822F956A6017AAADD8182F5609DEB09A6E851D3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242057Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:48.884{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242056Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:48.884{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA33007DDD486027CCD24AF25BAE7D5D,SHA256=6728B087E36623DF23298CEB8BDD0CD715DF084BEC6660DE3D8F8FDF3681EFF6,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242059Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:49.891{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242058Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:49.891{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47603246BE5A7C198747262C269C58D6,SHA256=8A8B816C4BEF1887480EEFBF555EC03357347B77E817FA3CDE103FB349788232,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242061Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:50.996{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242060Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:50.996{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C6EED035723F4265B5BA42095D91912,SHA256=B8FB99E6D40E059401F0D1D71902D4A6BCB155D4A655E90179F74AA5391D660F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242062Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:48.571{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57756-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242064Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:52.102{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242063Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:52.102{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFCC93BADE4E00452694ED79F46DF401,SHA256=33E2D98335A6ABE5A82B72D278BA6B47A3D0AC71761B6F474B37ED6E034C6AA6,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242066Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:53.107{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242065Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:53.107{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86CAE5E51ECF61B29E0938BEA830850C,SHA256=BBC714F2418E029038E6FB84B981DD703747E040D18E783EE11FD943B3C5DD2C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242068Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:54.211{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242067Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:54.211{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1F4C6DCC5CEEF530C77293AF98E748B,SHA256=FF92D8CCE1957DB150E5840CC0B91C710E505674B2088FBD60EB3FFB3D199D76,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242070Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:55.316{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242069Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:55.316{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CAB786E24B88F86E35E606061E1F1E10,SHA256=E1B95754753F51B7BC8B81D43B654B7055F3216F90EBC23CFDF175B1C77418D1,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242073Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:56.419{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242072Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:56.419{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=347F5BFB620A66856B7F46836D11AAA2,SHA256=E56BF33AB3D4C81485C86C1E03C1667E9D1A6C6E3CB71E2D75257016DB79F0AE,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242071Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:56.118{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:12:56.118 354300x8000000000000000242076Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:54.457{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57757-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242075Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:57.524{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242074Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:57.523{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0095ABF8FDB98F9C316007DE90E71902,SHA256=E99A572E99A2C6AF682A77F4544347ED905D01CEE7645CC847D252D4E82FCE6A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242078Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:58.529{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242077Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:58.529{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B42E8A40C5F4E3EC8F1B090874488264,SHA256=03D8997FB47C4E44A6CA91B8567603C01488726143EF0A63965DDFDF40F97A00,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242082Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:59.632{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242081Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:59.632{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=29DE7C323E165D50841C23638888C3BF,SHA256=F108042E54D46271DADA2189C1CC25B58A67782BEDD491E1AF9BCB42C37171D9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242080Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:59.295{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat2022-04-20 14:16:57.501 23542300x8000000000000000242079Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:59.294{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=C5192700F7CD468C13913B4DF960EAF3,SHA256=4588F5F9CD6A8C126CBA8A3779FA5BE8ECE77404DE0151A459D9B7B6B285E73D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242085Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:00.736{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242084Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:00.735{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=689B39B49D27C1ABFDFE5B5C15E5916E,SHA256=A731B7D7FF7BF83DD23BE6C7B830B3BA7F1F09D8F7EB6B41F2AD195EF0CC8B72,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242083Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:00.019{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=736FAAF56A5236BFF0096DFBA4B79825,SHA256=BCF134C318A7E1D8F3FCF9F9561763D653196CBCB15FDF60B20378892042D8B6,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242087Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:01.840{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242086Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:01.840{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AAB6B437076F5B4B501A00DD906B24FB,SHA256=BC4EFC592BE67C8AFCB9DD6C8E9911324BAAE51A122653815A2FD3E7D1A81B5E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242090Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:02.845{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242089Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:02.843{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F70C118F4A201AE87C4D404F45B8CCC9,SHA256=6F016D2A9449D3D7C6E484D169DAA7440B8C8641C9824339E0C40C6CED53E8E8,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242088Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:12:59.520{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57758-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242094Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:03.849{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242093Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:03.848{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9396EB8A28B24D135B11144AD27FBDF,SHA256=AFE7431D4129E8DA61F459660D5390B694E5110A5F405E77AD20962CFB8EF991,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242092Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:03.257{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000242091Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:03.256{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242097Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:04.854{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242096Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:04.854{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE8825C2F8EAE87DE182C0109FC94FB0,SHA256=4BF7A9639016686E2EF691779700288D36A3AF2CC6ED0A9093298ECCB6D07251,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242095Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:01.647{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57759-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8089- 11241100x8000000000000000242099Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:05.957{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242098Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:05.957{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63FDF53484D6098DCEB27E014AD957C4,SHA256=ABFE23365E512CA5E35AC428EA8C0FF0D1C8F023375BFDCC37F001F407754E1A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242101Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:07.062{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242100Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:07.062{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B394B6A6E5C3B5DE4E31C47EB5CE943,SHA256=8EA35902DA8383D28AB5925725298DF006BC6145E269BAEE71C2753F3C7ABED7,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242104Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:04.604{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57760-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242103Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:08.167{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242102Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:08.167{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D1170C897CB76E3E6143896757B749A,SHA256=DFDA6867061464408D7D48E7574C5C0DD23E47CF395173523CE14FA7E952B865,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242106Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:09.270{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242105Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:09.270{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D2680CAC9C20596E190D3EF1D2E9046,SHA256=D3567DC093AFB24B287C351199CAFE97617ED06EF30B6E179341CFC928B5ADA8,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242108Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:10.375{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242107Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:10.375{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52175F9E2799303C2A8B53BBB7798EAA,SHA256=1E90CE7CD2D77AD2D8E31E213E4F7189E7E173D86EB1B4DB848E780F33A954F7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242110Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:11.478{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242109Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:11.478{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=418C980259D00395466687BB43B2363F,SHA256=DCD1D4ECF572FED61758464C753BE8684D41EA7E7546CC7C86ADC5A3E44FDC7E,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242113Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:09.619{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57761-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242112Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:12.487{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242111Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:12.487{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A1728B6CF76C8D72E8532769E198DBB,SHA256=B617D1A7D3A00A298D98806A70584CEB234C6AED518EB2891F43775C7C6D69C7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242115Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:13.591{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242114Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:13.591{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C7AA54248431035F17B2C55759E85AB,SHA256=6DDC31CA261D9544F312BD62C5293FE6F9F71269B46FBF33325D238EA516A351,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242117Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:14.601{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242116Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:14.601{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E37A415CC9DC8BCE0F5559D074C36321,SHA256=FA8102799DF9F534DC82A5B05F96B714D5CC7AA68EEF074A61ACC2FC10D67131,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242119Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:15.705{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242118Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:15.705{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F066615830750CA217FA71645BED5DA5,SHA256=8A869FC4976F34DFD7AF74F4043E4B221787625FE8A9A69859938800C3DF5C7C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242121Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:16.807{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242120Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:16.807{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B1E72098929C3DD3C6B5C6269342F7CB,SHA256=23A14AABE728487DB6F09AA7C0B6866DCBA07FFEF2063FF83BD40C84FF61B9DD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242123Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:17.810{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242122Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:17.810{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=230703FA5DD932BBC161071C531804C1,SHA256=03BA06D7E898EDB45F971499D01753ADF6D9265A17D19879248F38DA9CFDA6DD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242126Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:18.913{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242125Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:18.913{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D65E5404F6BE9E2AEBFCC2BD3A8C815,SHA256=33E4CC1AED2221C044C2CC5A7E4101777327763BEB9F378FFB661C834BC4C488,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242124Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:15.445{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57762-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242131Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:19.919{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242130Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:19.919{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA86F6366817F018C1B0D9F7FD62E0BC,SHA256=3556F6F41C29FE509AB9C049D5D4566F784966A5152DD8067685BF0CEE3F314F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242129Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:19.471{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-159D-6260-1500-000000004402}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242128Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:19.470{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-159D-6260-1500-000000004402}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242127Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:19.470{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-159D-6260-1500-000000004402}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242133Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:21.021{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242132Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:21.021{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=54CF0EA76E8B33D22A458132B8CC105E,SHA256=E81DE19CE9A3826485D8252B88A4C9CF5D71CEB48022216B00F7D8F675564403,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242135Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:22.024{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242134Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:22.024{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0F6D6BD9C04DA7FDF8E2319B302A1DC8,SHA256=F3F5959BFB8FAB1F0825E855DAF082C9D8A48FCE70DA48C7D765305CB8721819,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242138Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:20.453{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57763-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242137Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:23.127{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242136Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:23.127{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AE89CACC235AB35D542D746352DE2AC,SHA256=DD4437A89A576766B669747F8B2B5CEA97959F026FF4BFDE85259DE2CF06F28E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242140Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:24.132{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242139Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:24.131{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86C708903F5755EBC8E812108F009E82,SHA256=96634943F1D6FC2B59C471E0A3F07D1872AF1BF9A7E83A05161E526EC36488F5,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242142Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:25.234{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242141Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:25.234{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=10582A7568863DEBF8DA88F0BF14FD05,SHA256=C42826B522FA152F80C4B16C03554C77FBF59E8E3C1819F84D3AB04B42C569E7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242145Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:26.338{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242144Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:26.338{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=489E9BB19BCFE4E6BC14EB5975E6ED76,SHA256=43EEF8F5DFEEB561724A4C19B071FB1A2AF6FCE24C691FA8E294604F020B142B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242143Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:26.124{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:13:26.124 11241100x8000000000000000242147Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:27.440{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242146Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:27.440{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4F3CC6801C9BA544A3C4B871E8E6F12,SHA256=D9A1618E6ADE20033FA58AEA16FAE6340E6FB16C4BA86BB12AAD04BAEA1AEB6C,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242150Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:25.495{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57764-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242149Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:28.544{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242148Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:28.543{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=50BFB5123ABDDB1EA05BBB7D888611B8,SHA256=4B5C8B63C88F59062CABB8A397168C599E032F41A68FE736C4FAAA3F756A7554,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242161Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.630{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2319-6260-B702-000000004402}5576C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242160Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.628{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242159Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.628{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242158Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.628{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242157Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.628{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242156Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.628{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-2319-6260-B702-000000004402}5576C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242155Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.627{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2319-6260-B702-000000004402}5576C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242154Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.627{8D845A55-2319-6260-B702-000000004402}5576C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242153Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.549{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242152Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.549{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5181DBF921850EDB4232B6C58CC933FC,SHA256=6A7F0A2C2C6915B039AB5DFBAB5A8C2EC6BC06C8B638C69782E580537ADEB4D7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242151Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:29.259{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=DB46760B9D11E39A14B2B4B70D8D7336,SHA256=117F79CDB41EB8858C7FC5900982C841122FC4462C6B4D8E0A1335ABF77C9CBF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242183Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.961{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-231A-6260-B902-000000004402}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242182Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.960{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242181Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.959{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242180Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.959{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242179Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.959{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242178Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.959{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-231A-6260-B902-000000004402}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242177Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.959{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-231A-6260-B902-000000004402}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242176Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.959{8D845A55-231A-6260-B902-000000004402}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x8000000000000000242175Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:27.682{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local57765-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000242174Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:27.682{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local57765-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 11241100x8000000000000000242173Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.659{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242172Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.659{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C9871252B1B4059B8330C80D255DB1E,SHA256=E2078F603A0D6740832978058D0A1EF228E5BE10692D876808E8D292EC12C646,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242171Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.390{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000242170Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.389{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B5EAB004D3DFDB783681C97EAF5ED28C,SHA256=431FE36977690FA18CBC4C51F0976A10128495878F5D6E5D632E5F8C0FED8DF0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242169Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.294{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-231A-6260-B802-000000004402}2412C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242168Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.293{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242167Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.293{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242166Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.292{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242165Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.292{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242164Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.292{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-231A-6260-B802-000000004402}2412C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242163Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.292{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-231A-6260-B802-000000004402}2412C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242162Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:30.292{8D845A55-231A-6260-B802-000000004402}2412C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242186Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:31.767{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242185Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:31.767{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=488A5E87F68500D0C465163E8D3079C8,SHA256=E2652C855114DF3A001F1FC68C25CF4B8A0D2E3524E88EB9F72988C4B615BD6F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242184Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:31.128{8D845A55-231A-6260-B902-000000004402}42044332C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242207Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.884{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-231C-6260-BB02-000000004402}4080C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242206Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.883{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242205Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.883{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242204Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.883{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\AlternateServices.txt2022-04-12 13:36:19.111 10341000x8000000000000000242203Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.883{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242202Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.883{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242201Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.883{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-231C-6260-BB02-000000004402}4080C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 23542300x8000000000000000242200Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.883{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\AlternateServices.txtMD5=4FA74B62D6387707C7CA607B916D152F,SHA256=A79A6807ABB75A8C2BAC2A79A5B8D41D794E24A562004803AFE17B0FDFCD6FBC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242199Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.883{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-231C-6260-BB02-000000004402}4080C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242198Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.883{8D845A55-231C-6260-BB02-000000004402}4080C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242197Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.875{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242196Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.875{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE6DB7B8566FA9CB53C939C8B4107192,SHA256=44BE4A3EA25E315363BE46BFBA7227CFE1FBD51AC19C0E0820C1FB284D1A820A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242195Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.416{8D845A55-231C-6260-BA02-000000004402}55485180C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242194Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.207{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-231C-6260-BA02-000000004402}5548C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242193Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.203{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242192Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.203{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242191Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.203{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242190Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.203{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242189Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.203{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-231C-6260-BA02-000000004402}5548C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242188Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.202{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-231C-6260-BA02-000000004402}5548C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242187Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:32.202{8D845A55-231C-6260-BA02-000000004402}5548C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242223Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.986{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242222Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.985{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5453EF801B916FFFE55D8EAC54976274,SHA256=7ABB7D5C86E88A24BFC1855A69CCF1451A37D3E869ADD223274F3123624ADEB8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242221Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.729{8D845A55-231D-6260-BC02-000000004402}19201300C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+610325|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60fe56|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60943|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+9e7f20|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242220Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.556{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-231D-6260-BC02-000000004402}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242219Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.555{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242218Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.554{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242217Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.554{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242216Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.554{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242215Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.554{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-231D-6260-BC02-000000004402}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242214Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.554{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-231D-6260-BC02-000000004402}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242213Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.554{8D845A55-231D-6260-BC02-000000004402}1920C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242212Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.263{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm2022-04-20 15:13:33.263 11241100x8000000000000000242211Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.263{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal2022-04-20 15:13:33.262 11241100x8000000000000000242210Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.257{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm2022-04-20 15:13:33.257 11241100x8000000000000000242209Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.257{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal2022-04-20 15:13:33.257 10341000x8000000000000000242208Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:33.064{8D845A55-231C-6260-BB02-000000004402}4080972C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242234Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.994{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242233Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.993{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EE4B4A0978D573792E1F181FADCBADB,SHA256=16D444021FA0EA8F8DB23F83EEFD696E22CB24BFCEBCE283F4351B2266B60A8E,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242232Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:31.435{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57766-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 10341000x8000000000000000242231Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.220{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-231E-6260-BD02-000000004402}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242230Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.219{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242229Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.218{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242228Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.218{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242227Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.218{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242226Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.218{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-231E-6260-BD02-000000004402}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242225Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.218{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-231E-6260-BD02-000000004402}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242224Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:34.218{8D845A55-231E-6260-BD02-000000004402}6084C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242236Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:36.095{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242235Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:36.095{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1D6F2E6B6EC535886F99AAA475329DC,SHA256=C24833686F583166D4038BF5434B79749EA095E5B0AC0D94D5B69EF604266BD8,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242238Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:37.203{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242237Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:37.203{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55A8764BCA954946D306461BAA4B38A1,SHA256=4FC9DBDCEAA814B80073B91EC9EA063EDD67F1FA18828871866D43343ECFE114,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242240Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:38.308{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242239Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:38.307{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2163E2C46DA2374DF49F42A88FA4804D,SHA256=5BB9A6565ABC56AF5007F82C39111494B758C54AC65989552DB31AD853103B67,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242243Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:36.514{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57767-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242242Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:39.313{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242241Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:39.313{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1D145FC1940687DD4DCA16B2BC8C2736,SHA256=96726753FEA45B9C9A4E554C89EF1102F59EAC662686838FFD9F8F8065B523FB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242245Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:40.416{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242244Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:40.416{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17C6F131391B5C6EF62451294553401A,SHA256=BF64BDD23879AFAA2DCBDAFC8860BC3992989CFB924F987AA94A10D7A7E6E08A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242250Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:41.526{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242249Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:41.526{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DBB0FFF8AA8AB2A300E952F415AC884B,SHA256=32818A900177774D6442E168103F778869BC5114454EF7156E2F37FDB38DC84B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242248Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:41.448{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\respondent-20220420141616-055MD5=8D93873C901538A8B2B909297EDAE7BB,SHA256=9423023AAA5D37B26F7EE3576993D2852CE2F95EF8E5E497C042A8474DDD26FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242247Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:41.447{8D845A55-15B0-6260-4700-000000004402}3580C:\Program Files\Amazon\SSM\ssm-agent-worker.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\respondent-20220420141616-0552022-04-20 15:13:41.447 11241100x8000000000000000242246Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:41.446{8D845A55-15AE-6260-2D00-000000004402}2972C:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\surveyor-20220420141614-0562022-04-20 15:13:41.446 11241100x8000000000000000242253Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:42.532{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242252Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:42.532{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B9C69081F5B338F44C81A307BD69B14,SHA256=606EB313251C2C7B09A676CC373954813078060EC115DAE1D8D30C4D10849FA7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242251Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:42.447{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\surveyor-20220420141614-056MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242255Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:43.636{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242254Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:43.636{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03743CF6CDE2C46746B48FB3017207E0,SHA256=5452F73DFD6479C300D95089EDA5C6D28EB8D83142DEEB741852993A5CA4140F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242257Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:44.739{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242256Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:44.739{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C65227228CD741DDB13F9064764E64C1,SHA256=066FB135F0F1FC1C9C8C3EFD995FBFC79857EDF8EFD1086FCD250313CF4CC8FA,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242262Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:42.503{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57768-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242261Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:45.844{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242260Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:45.843{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9BA6FB2FD7A89178B87A39EDF974AD02,SHA256=BF95BE36FD64A2CC5788CC3C00A1BBFA571A5C049D151A7243867BD2B1095E68,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242259Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:45.268{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242258Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:45.267{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmMD5=6F49DFBA80F17DD12EB5F0242AEB6698,SHA256=51700D8363F0AB6159135F908EE8D316AE85E2F5FA3D5728DB4D03F9D10F6751,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242264Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:47.150{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242263Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:47.150{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C4A842F8FB977B4EDD198089BB280DF8,SHA256=C1D785C60B500737953010DF6401FF75CF4A70A5D135B6D604156DD1C68BEABB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242266Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:48.154{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242265Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:48.154{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE05EB7CE7B0D362CC5B678789A2134F,SHA256=48D3728E439B0497EE84EC94CA2FD7A5612AAA51741B7C97D775DB242786E1C2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242268Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:49.257{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242267Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:49.256{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2A74E331253E2B982E0B6EE2240F5E0,SHA256=D1B2AD7981B2003678390750C28B2ACC053965BC4F99EA40E0338CAB828F23FB,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242271Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:47.600{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57769-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242270Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:50.261{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242269Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:50.260{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8668AC635B0B1437EA24A66C0ED4F8A0,SHA256=7F578F7CE7C8ABB34B3158535A60761241E7CB195005C1ECF9E8A06E6C69750E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242273Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:51.364{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242272Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:51.364{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33A4E4E1C5CED08874069E6BF3506599,SHA256=4DD1382588DA1B98528EF97751AB64DB5E15F506387A082E7ABBA892552D0462,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242275Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:52.371{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242274Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:52.371{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47557355561B5CF6F30347118DE0397C,SHA256=B69BD22100B0224F73E5F4C9ED5469B197885A949F0BF9382ACB2B68CB98ADC9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242277Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:53.379{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242276Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:53.379{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BCB11AA92FD8FEB803A51BC6B942DB9,SHA256=C3F554F74AE160A1D4698E107EFEAD4FD517FE300AB0B4719728A1D99481B787,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242279Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:54.482{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242278Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:54.482{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40F1469826AD68F41B9B9C526EA8F678,SHA256=429212A30EF0BC73A03D66CEB5E2368C564D1A7B976413983F171D882E2320AC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242281Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:55.488{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242280Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:55.488{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7E86B138A9DC26AA4CAF1BC5FF06BB6,SHA256=174096F7DD2A3AAD638C16F1451AC68A32067EB9887DEC636A923F3EB83FF5F1,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242284Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:56.592{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242283Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:56.592{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E015FED7B6EA091C202D7372CC202C0,SHA256=5255B91B1A97B41CFA816434C333ED3C43A7865A416B2B7710AF621F268CEC29,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242282Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:56.117{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:13:56.117 354300x8000000000000000242287Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:53.426{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57770-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242286Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:57.696{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242285Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:57.695{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08F9B3A36437CE364F90ED66BCE18099,SHA256=68655EBB383854BE2212D95B287F1ECC500445C4F559748A3468FB87C5D4E2E4,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242289Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:58.700{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242288Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:58.700{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CA24413B5C1C7BF4C0117994F67B7D3,SHA256=A132E427522E99C6B2919503AAE7EDEBB42EF6D5617828A052055AFA2181AC2E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242294Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:59.805{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242293Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:59.805{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C54C43395940523C66E43D0D2B52377,SHA256=DA3C9DC21B2C167B4266D1B111B9C3279EA7C797E551CB491D6E1500111A176D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242292Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:59.289{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat2022-04-20 14:15:57.498 23542300x8000000000000000242291Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:59.289{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=0003603650DDB72E2E32CBF848AFCDBB,SHA256=0D7D913830645F1F1811830A9DD35DA2478EA3832D3223C165A3AA9DA196507B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242290Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:59.267{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=E4AB6C4DE9CCDA606079B265A90F22E1,SHA256=12F5BEEDC35EB7738EB9D029B831815CCD8B601A817FFD2A2394100DC7490107,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242306Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:00.911{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242305Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:00.911{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5BDE1E5F09C7A04E3B6E026FD0A53E25,SHA256=C7C5C60CCE271518B8318DA0BDFA6D6D12A020E9523EDD924ED57FA2D9111FFE,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000242304Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x8000000000000000242303Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00353e01) 13241300x8000000000000000242302Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d854c0-0xe1545bea) 13241300x8000000000000000242301Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d854c9-0x4318c3ea) 13241300x8000000000000000242300Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d854d1-0xa4dd2bea) 13241300x8000000000000000242299Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x8000000000000000242298Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x00353e01) 13241300x8000000000000000242297Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d854c0-0xe1545bea) 13241300x8000000000000000242296Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d854c9-0x4318c3ea) 13241300x8000000000000000242295Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:14:00.157{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d854d1-0xa4dd2bea) 354300x8000000000000000242307Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:13:58.430{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57771-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242309Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:02.014{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242308Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:02.014{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1700D73E7679A00FF807E153E7CC434,SHA256=69ECB9C55C17DF5A74410D42489A91E6E569EA206CB2B921C1DFDDB5FEB9F31F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242313Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:03.267{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000242312Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:03.267{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242311Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:03.118{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242310Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:03.118{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=098FDD32E58F28BE0A1AD161F52248A2,SHA256=33E72C8124B59F62FDC3596E350B3A96976CD7118D2DDF98BA69BABD293D8CDE,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242316Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:01.654{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57772-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8089- 11241100x8000000000000000242315Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:04.124{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242314Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:04.124{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC4E1F3131A30C394328A1806E01B1D6,SHA256=7823D0C0FE2D64F292284EE7EBE438505867F4563AA871DEFB32BCB70743FAB6,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242318Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:05.228{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242317Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:05.227{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3071552BE9403BCA422A3844BFE3DFC5,SHA256=BA8BDD77CBD99A81D3A1D06DB23D8975630C8F399B9BFF2B6C6428791B393577,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242321Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:03.594{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57773-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242320Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:06.331{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242319Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:06.330{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B619A10E4AF0BED14298D4A8A384362,SHA256=CBD20CEB63C9AC6D2135BA7C4CCBCD90CC2D23E3E66B56C64D33219CA41C7977,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242323Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:07.433{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242322Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:07.433{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E9ACC7D5737466252C60AAED174D461,SHA256=CD0FED43915598692FB0A63A3344E472C5EB07AB08D29600085719BAB0C312ED,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242325Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:08.436{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242324Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:08.435{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BBEA4D887971BA84D841D7C928B83E7E,SHA256=94D8237F169BDF7D29C5C6534192EF26AA467D234B56AC2FEE837662C6295B64,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242327Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:09.540{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242326Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:09.540{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6596E92337F31F147455885E2160A0F4,SHA256=EC847CD3A86454BE42B89E25A15A193451C656127C5992500EBAE0E28C94AEB2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242329Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:10.544{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242328Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:10.544{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B12DCAC2D493E308D77905E206B8B320,SHA256=DC908F2C537E22C6DE7C4CA8F8D11714EC3DF9275DC98792F22CD10161125DAC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242331Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:11.649{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242330Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:11.648{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4499B50D9948D2A82458E0C1BBA56791,SHA256=E3E9C169297A566E25FC07DCBB277B2FCDECD23E1ADDC9F179B33E84D303820C,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242334Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:09.499{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57774-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242333Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:12.752{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242332Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:12.752{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB45382134B277E73CF3A605385C7B65,SHA256=7EBC449BB36C3FA5466EF20C6D2EDFFCA86D0B1A80FA2418037466AD973881E3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242336Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:13.856{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242335Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:13.856{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6FBDF1C28BE9BBFB52B180B21631EB1C,SHA256=8EF04865DDF277C4AB9555A00E1759E6A65231B0F7639F65A8530602CE803136,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242338Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:14.960{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242337Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:14.960{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A902D007A1637C1C602EC5AB55A992A,SHA256=6F68122676CBE1897311C0EE5F8B5640DE78D8C8E7A05804F000F1B257B42346,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242340Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:16.066{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242339Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:16.066{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AA1476F2D1E98B496CB769C4CDCA3F2,SHA256=3CDF6AC844DD6A3E5E495788CE6219F1FBB478CDB6F2143CD1EE6CBD355B42C5,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242342Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:17.172{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242341Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:17.172{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6957029EF43E5B7CBE092EFE9A518207,SHA256=CC05BD5DC7422721A5492C232AE36A9E66C71B057761D8B489183D307596C451,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242345Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:15.463{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57775-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242344Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:18.377{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242343Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:18.377{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B54EFC9392E2072403DED5D3B245655,SHA256=D0F93E9D8BD6B96CDD55F3BC69013B15964DA8FCEDFB60D7C7AAD2232EB002D4,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242347Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:19.487{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242346Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:19.487{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C12837D96ACB15E831D504527172026E,SHA256=FBCF347D9953B291B8DDC5202444F337587E6373CEB9A4BD4F2D660881778891,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242349Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:20.692{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242348Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:20.691{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF6D3A6DE5CB0DF226CC7128DDE78920,SHA256=8C95F20733EDC7527D8A83CEB2C78A2E6866EF24DF54A0E47404239CD1E6237C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242390Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.888{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242389Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.887{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7E0388D5B0B143249116801E45F029E,SHA256=18C9E250102BF7823D47850F04546A4027276188AA6910E51FF4038180810AE8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242388Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242387Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242386Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242385Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242384Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242383Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242382Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242381Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242380Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242379Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242378Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242377Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242376Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242375Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242374Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242373Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242372Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242371Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242370Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242369Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.243{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242368Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242367Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242366Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242365Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242364Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242363Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242362Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242361Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242360Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242359Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242358Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242357Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242356Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242355Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.242{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242354Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.241{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242353Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.241{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242352Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.241{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242351Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.241{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-3000-000000004402}2368C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242350Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:21.241{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-3000-000000004402}2368C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242392Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:22.924{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242391Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:22.924{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D8329B434171D8091105C8B1B419E58,SHA256=527333BA8F4DD2C28B217453EFF91D1D6ABFD9DA1241E831BA4B4ECCCF9C6328,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242393Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:20.543{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57776-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242395Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:24.027{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242394Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:24.027{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A82D1E9F72943B14D9F4F5E6F90FA600,SHA256=1CF802229BC03E483D2F253DD1356C0AAC32E175EE8075E7305FBFA65CA72728,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242397Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:25.031{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242396Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:25.031{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=49FBACC8626BC41EAFA979706DBF84B8,SHA256=B0F85BA70E5BA05FEEA239562DCAE2195F552207712742F9F4BABDD48454943A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242400Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:26.135{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242399Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:26.135{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3549C9F1CFDD12899586261490FA13B4,SHA256=DD8CA6173057BEC4FE0BB36998E624B23CD04E817CC0AAB31A4C68EA6D4ED26A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242398Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:26.111{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:14:26.111 11241100x8000000000000000242402Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:27.139{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242401Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:27.138{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CCD844BBACA9365B36FD6B6E8100A64B,SHA256=9816D8C7D3589D00AA7A1462BE4C142CB46029F6A724722F7E299A1ACD02268D,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242405Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:25.574{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57777-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242404Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:28.153{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242403Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:28.153{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65A9E52CB2ACE75279F83EB09F51D2F7,SHA256=B81ABB18C1CC42D4A360509C43E467D469E07D263F09BDDA9D2CA0817973C983,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242416Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.520{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2355-6260-BE02-000000004402}5456C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242415Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.519{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242414Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.519{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242413Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.519{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242412Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.518{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242411Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.518{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2355-6260-BE02-000000004402}5456C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242410Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.518{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2355-6260-BE02-000000004402}5456C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242409Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.518{8D845A55-2355-6260-BE02-000000004402}5456C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000242408Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.490{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=45E84EE70F54E1802E45E73906E5D656,SHA256=8B650EDBD767884114BB01207E2DA9303EA8133631FF82D9708ED187DE6A8072,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242407Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.357{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242406Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:29.356{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=64BA87C0C7D09B366DBD620C113EC593,SHA256=496969DDCB0F96CA892EAA871F04DD634F593A846349FC0F207491D172A489F8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242438Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.852{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2356-6260-C002-000000004402}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242437Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.851{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242436Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.850{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242435Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.850{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242434Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.850{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242433Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.850{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-2356-6260-C002-000000004402}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242432Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.850{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2356-6260-C002-000000004402}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242431Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.850{8D845A55-2356-6260-C002-000000004402}4712C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242430Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.561{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000242429Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.561{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2ED64A3B3DEAD20C4A9F96EA959D3E44,SHA256=5A2234AE8F55C8E09BA4CA4ABA39861D587A772D6B4C33D167150BCADDB81D37,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242428Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:27.698{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local57778-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000242427Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:27.698{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local57778-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 11241100x8000000000000000242426Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.367{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242425Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.367{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D9753B3A08B0FE6D62868B40EBC417E,SHA256=7A6B027FECDC894968E87FA0EFA4979BE0F589A623F608F5148B21DD456196A3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242424Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.186{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2356-6260-BF02-000000004402}5788C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242423Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.184{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242422Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.184{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242421Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.183{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242420Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.183{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242419Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.183{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-2356-6260-BF02-000000004402}5788C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242418Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.183{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2356-6260-BF02-000000004402}5788C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242417Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.183{8D845A55-2356-6260-BF02-000000004402}5788C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242441Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:31.475{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242440Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:31.475{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A7DE46674EABC6658F6C2CA900E8A49,SHA256=F755FF05A799149AE9C288868A55890E5F094D649A234D185FA6F247278E0802,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242439Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:31.016{8D845A55-2356-6260-C002-000000004402}47125576C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242461Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.804{8D845A55-2358-6260-C202-000000004402}42045116C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242460Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.631{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2358-6260-C202-000000004402}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242459Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.629{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242458Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.629{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242457Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.629{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242456Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.628{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242455Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.628{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-2358-6260-C202-000000004402}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242454Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.628{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2358-6260-C202-000000004402}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242453Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.628{8D845A55-2358-6260-C202-000000004402}4204C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242452Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.583{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242451Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.583{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=304F717DD598BF880264811399609FEC,SHA256=1642911720A5B39AAAA5832B542E5CD885B9F7FD55D53E7B5BCF84900C998FAD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242450Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.304{8D845A55-2358-6260-C102-000000004402}24124936C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242449Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.112{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2358-6260-C102-000000004402}2412C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242448Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.111{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242447Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.111{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242446Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.110{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242445Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.110{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242444Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.110{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2358-6260-C102-000000004402}2412C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242443Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.110{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2358-6260-C102-000000004402}2412C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242442Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:32.110{8D845A55-2358-6260-C102-000000004402}2412C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000242487Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.961{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2359-6260-C402-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242486Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.960{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242485Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.959{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242484Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.959{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242483Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.959{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242482Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.959{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-2359-6260-C402-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242481Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.959{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2359-6260-C402-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242480Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.958{8D845A55-2359-6260-C402-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242479Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.693{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242478Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.692{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B9E1668C38BACCB5BEB8E5B67C6B82A3,SHA256=10D580DD38CCC5CC6682E55A8AEB7F9D3F62676F24ED809D7B00A9179AD40C77,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242477Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.637{8D845A55-15DF-6260-9400-000000004402}43242492C:\Windows\Explorer.EXE{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+6497|C:\Windows\System32\SHCORE.dll+6387|C:\Windows\System32\SHCORE.dll+62fd|C:\Windows\System32\SHCORE.dll+620a|C:\Windows\System32\SHELL32.dll+af4a0|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9824|UNKNOWN(FFFFF800B9E62B58)|UNKNOWN(FFFFFDB12ECA5B88)|UNKNOWN(FFFFFDB12ECA5D07)|UNKNOWN(FFFFFDB12ECA0391)|UNKNOWN(FFFFFDB12ECA1D5A)|UNKNOWN(FFFFFDB12ECA0016)|UNKNOWN(FFFFF800B9B78503)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+b2cfb|C:\Windows\System32\SHELL32.dll+5360a|C:\Windows\System32\SHCORE.dll+33fad 10341000x8000000000000000242476Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.637{8D845A55-15DF-6260-9400-000000004402}43242492C:\Windows\Explorer.EXE{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+1c0e5|C:\Windows\System32\SHELL32.dll+aef81|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9824|UNKNOWN(FFFFF800B9E62B58)|UNKNOWN(FFFFFDB12ECA5B88)|UNKNOWN(FFFFFDB12ECA5D07)|UNKNOWN(FFFFFDB12ECA0391)|UNKNOWN(FFFFFDB12ECA1D5A)|UNKNOWN(FFFFFDB12ECA0016)|UNKNOWN(FFFFF800B9B78503)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+b2cfb|C:\Windows\System32\SHELL32.dll+5360a|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 23542300x8000000000000000242475Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.637{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF35c0cd.TMPMD5=DD8C29AAE0A45C3822ADE0E7CA84C037,SHA256=448C743772008F1A6623E6915E6111011845DFE3385A89996681D81E97DA526D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242474Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.636{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF35c0cd.TMP2022-04-20 15:14:33.636 11241100x8000000000000000242473Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.632{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JLHY743R154XYCT760BP.temp2022-04-20 15:14:33.632 10341000x8000000000000000242472Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.457{8D845A55-2359-6260-C302-000000004402}55481960C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+610325|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60fe56|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60943|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+9e7f20|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242471Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.297{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2359-6260-C302-000000004402}5548C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242470Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.296{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242469Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.295{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242468Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.295{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242467Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.295{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242466Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.295{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2359-6260-C302-000000004402}5548C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242465Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.295{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2359-6260-C302-000000004402}5548C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242464Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.295{8D845A55-2359-6260-C302-000000004402}5548C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000242463Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.012{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\aborted-session-pingMD5=8099A92A232F811C4173394B08D8B4E2,SHA256=AA6E5703C1DD5E3CC0B1E7EF4E4098396FF2CA448AD64170CF36BF44D0AD6CED,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242462Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:33.006{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\aborted-session-ping.tmp2022-04-20 15:14:33.004 11241100x8000000000000000242491Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:34.700{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242490Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:34.700{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99B14600C9CE309673FECB41B83C3449,SHA256=131670AAE51B1E1DE535D4CB7C09187F60EF90A26EB004D427344D8BA8704040,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242489Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:34.624{8D845A55-159D-6260-0D00-000000004402}9005648C:\Windows\system32\svchost.exe{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3d877|c:\windows\system32\rpcss.dll+29a97|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 354300x8000000000000000242488Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:30.602{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57779-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242493Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:35.803{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242492Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:35.803{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7361BD302569560AD5C7D5F1FCE33E9,SHA256=341176E8A2C64AF7BC3F30E17984510ADF856C5C2AEBCEF4F1A39E6DAD39EB7C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242495Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:36.908{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242494Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:36.908{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EED0DD3DE047A0A0CC243D804C070B24,SHA256=1366827BD098A0487B02CE5B62D02480873128431778C203C98E70694CF13F9B,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242498Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:35.636{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57780-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242497Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:38.014{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242496Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:38.014{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9556C6C8C9837B2CBE58EAD91F1F2733,SHA256=7CF240BD3F5B07F0F87E784A2BC11E7B7CD6544CCFD4F6DAAADF29A60D88FB59,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242500Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:39.117{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242499Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:39.117{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8595CEE12529B45AF04C62FF5182C96,SHA256=BD943D740809A26855B377CB5F30F446D49D77446126D07E6173A6AB7A5BFFF2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242502Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:40.221{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242501Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:40.221{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F65527EA898D3AB8B6B14699D759773A,SHA256=D9FF0C77A9CDC6DC0615C6A72971F252E9B1C4E3316690B130092EB115960FBB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242504Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:41.324{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242503Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:41.324{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B78CCF522DCC1BCEA1CCF80BC3E442C0,SHA256=2F6B5F009FAFA8479BD3903DE9ADDACABBA27BD3C1BF64429D3F12143F6898EE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242509Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:42.947{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\respondent-20220420141616-056MD5=8D93873C901538A8B2B909297EDAE7BB,SHA256=9423023AAA5D37B26F7EE3576993D2852CE2F95EF8E5E497C042A8474DDD26FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242508Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:42.945{8D845A55-15B0-6260-4700-000000004402}3580C:\Program Files\Amazon\SSM\ssm-agent-worker.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\respondent-20220420141616-0562022-04-20 15:14:42.945 11241100x8000000000000000242507Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:42.944{8D845A55-15AE-6260-2D00-000000004402}2972C:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\surveyor-20220420141614-0572022-04-20 15:14:42.944 11241100x8000000000000000242506Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:42.428{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242505Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:42.427{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0D8BA1A142BDE07245DF3DD5701BA14,SHA256=0DCCD23E6C219FEB29A125245829DAB29522A69843900EC4103C5DB7AA7AE262,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242512Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:43.946{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\surveyor-20220420141614-057MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242511Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:43.532{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242510Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:43.531{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF45A2B39D10DC1CB46AAE516C2E3663,SHA256=2FA7FBF8F0F7E1378E99AF8459D252239293F4D82AED2D3B1CFF9B16DCF9C675,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242515Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:44.633{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242514Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:44.633{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5CAA990463D85B4C3D3056B0CC2D52FF,SHA256=4C51D6234929B026856BAE4A83DA18E1A72E8C08ED0E8C2D6AC498B3DBEAE31B,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242513Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:41.456{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57781-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 10341000x8000000000000000242524Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:45.793{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242523Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:45.793{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242522Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:45.793{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242521Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:45.788{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242520Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:45.787{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242519Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:45.787{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242518Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:45.787{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242517Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:45.638{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242516Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:45.638{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=42903F0EBEE51E43196715FF6CDD48C5,SHA256=760B14CE6AE5F9BA0D9ABE04F7C31C9E551A64770EBD99181F92CD00CCD4F938,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242526Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:46.745{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242525Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:46.744{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=169D66EB353C91C58DAD1B12B50CE328,SHA256=DC039EF3A8B90217E023BA2377C91EE41C3030B5749748FF33612BA96EC4B1AF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242528Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:47.850{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242527Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:47.850{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E3B5ADD3AF2269CD9B011C9A94A5523,SHA256=58EDDDB4CDA5E22539D6165F33997E78F0613BC327107FB8740BA357F4FE8B92,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242530Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:48.956{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242529Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:48.956{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA221738CE8374E13C6FAE5F1AF55698,SHA256=5AF5345D936A3DF65268700D27F06AAB7EE95B3A4CE5107E9841D9E5DB5975B6,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242531Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:46.527{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57782-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242533Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:50.060{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242532Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:50.060{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=90A90D896CEBFAD2BA8760D890ABC5EB,SHA256=9D9838A5A571475AC63CDA6A98CED8C49D6FBCB7ADE2D1B5FF284D1E4B89D72C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242535Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:51.164{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242534Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:51.163{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4ED56F708F929A3C7A8570F9C9CBE193,SHA256=4197210C321B1ADCDE0D246CF16994689E54AB2AAE34406CDF5996DCB8F0D1E8,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242537Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:52.269{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242536Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:52.269{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD5CF130F0B89AA333A6720805622DC8,SHA256=DBBC97B0E797C597D1855C20EACD25C596BA0B5EB6912438EE50E77C5E8C589E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242539Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:53.372{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242538Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:53.372{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=631E8832097E66B6E20EA4AD61D544A9,SHA256=F85FB7A4E84EBD6ABD5EF01A9F261BB1DE027024F834A0434C46AABDDD429F35,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242541Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:54.478{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242540Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:54.478{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DE9456E7FCC4B376FF78422F111F908,SHA256=EF909B01C1D16CEC59F2EE7042618C91D749A6B3BA0BBB95959A6375CF95CBEC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242543Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:55.481{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242542Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:55.481{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BCAF2A77878327EEBF9CF16AC55ED0A1,SHA256=EB8FB296D4C3BF50DC746CD15B14E6CB920A031076283E25C07890CD22D2247E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242547Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:56.586{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242546Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:56.586{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F6C933C87D9D1631A3C94ACE647D168B,SHA256=DE637126B77DCF93E8FFCD41F557245BE2404B2CE7D9A0C3544BA55FBBD4EBDF,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242545Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:52.457{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57783-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242544Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:56.113{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:14:56.113 11241100x8000000000000000242549Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:57.691{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242548Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:57.691{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97137033B591D1699854FBD68AE51D76,SHA256=098BEAB69092EE4F46AAC6EBC0F5823855974933AE425C712B1BF2A3E83ECEB9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242551Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:58.796{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242550Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:58.796{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B2052A187D9DDC1031A237DFCE773B0,SHA256=928F1905D52FD1A3FF1A8758C030B391DF5EA76CB1172F8EA3BF8C1B107E57B7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242556Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:59.900{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242555Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:59.900{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD9BA99B168E661E40B3896BA052207D,SHA256=EFA843F61C0DB9A0611229003FA5CB4B5C6E0B852641688F26BF74092F9A1DF6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242554Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:59.668{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=8DE5EEE8468403612A7F4F9159A25483,SHA256=CA5BE3B9B49268851DB33B75D3CC1B1152ED36E724B9C89ABDA4325A68D42A0C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242553Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:59.284{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat2022-04-20 14:16:57.501 23542300x8000000000000000242552Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:59.283{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=00FEBE03566338F865C232F169349FD3,SHA256=AE6770A664691CD11D5D13A42E68C4F0312E1A1F60ECDBA1378E8ADA306562ED,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242559Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:00.571{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000242558Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:00.571{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=336D57E60F20809DD02B30F826316D04,SHA256=8F13A8491C296BC5E22FC147F0C95DA6890D36F105C1188DF5FA0BD860DB7A44,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242557Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:14:57.519{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57784-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242561Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:01.004{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242560Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:01.003{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=610C69B199995090A01C7BA5B63B8740,SHA256=03D6B396B8F52547C4F5E14EC9BD709197B700EECFA228DA9905CDB2E79A3318,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242563Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:02.109{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242562Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:02.109{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3556FB8D54BD18529245C4C1D56BF8E8,SHA256=0497ECAFD326B300DAA0FBF1FFA4D4CFCF3BDCF9A044FFB5356FB04D51B955DE,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242567Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:03.278{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000242566Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:03.278{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242565Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:03.115{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242564Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:03.115{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C6B6DA527C594994022A09CEB3997D9,SHA256=9606C01CF12C9C8360A031AFECE1E2413F66313786D64BCEB5C865433AF64D00,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242570Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:01.671{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57785-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8089- 11241100x8000000000000000242569Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:04.123{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242568Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:04.123{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97A4B204FE0BCE7ECB79D3C810923FA0,SHA256=E84889DDDE93C034469676927FBE9DF283FF4B2E1D3A55D1C9BA664BBCDAFC53,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242573Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:02.651{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57786-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242572Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:05.227{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242571Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:05.227{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98920A55BE4AAE20F230A397E93EBB21,SHA256=DF8B14036A2A140C10806604E5109FC3C467F9C959F40E5019603BAA6164C051,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242575Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:06.333{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242574Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:06.333{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB28A0E9FF514BAABC9560592412D936,SHA256=7818E6EF700761F7131E6AD5F01F34FF1CFDCF67A94924FB9E6B3B15D8F705C2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242577Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:07.437{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242576Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:07.436{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB75D939557176FFE0A82C011CFF3FF2,SHA256=3F9E8239380E9B3FF525AAEBF667A94008081EAE6E83909343249C19C351985B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242579Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:08.542{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242578Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:08.542{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E368BCA921046B31B9D3197032B04597,SHA256=83ABBBAE1FD0F2BA1E2ABA6FA9546C87492FB70D63DC17AA540E15B72359DE95,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242581Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:09.645{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242580Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:09.645{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E3121B7C231DC9965C90C42CBD2B5D4,SHA256=13199B1AD96DE90D5A86A91B29DD95DF89ED1A398F3038197E4961247780A418,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242585Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:10.750{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242584Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:10.750{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AA7136E973A1879012C7FA21921CACF0,SHA256=3B90867760861BDB638618AF6F6342F425BFA8271DD0CB9EF22193E3A1D20C34,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242583Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:10.660{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000242582Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:10.660{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=4F25B422168C89D611EEA5AB00FCC713,SHA256=876E8182F2EE0BCAAFE623CBE7C2882439EA48BF259324D3A666F01F32BBF68E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242587Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:11.756{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242586Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:11.756{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D291ABB1D14D663A2894C0FB774DF39F,SHA256=91DBB40194D1866F4675B6F2E559A042AD50342B98C0BE2C3E5A01DA60A991DB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242590Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:12.861{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242589Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:12.861{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ADBAA366398B65F4B066AD0431BCB2BA,SHA256=5DF47D034F42BE72172BF9E093ADD364B2F370DB1071B90F4C7F585FA99DD067,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242588Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:08.483{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57787-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242592Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:13.965{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242591Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:13.965{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B906291DAEEC3D6A24E87CD848D83F5,SHA256=90498A8FFAD6D0CBC9165A1FADF58617A5FBBFDAFC16BC2DBCA83FA0530A5793,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242594Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:14.969{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242593Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:14.969{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C6F20C248932B59862693E7EE6600DD,SHA256=323655AB092097A0169E0BC7AED3AE52FD390E8AE63E441D9D64354DBBB66E97,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242597Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:13.614{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57788-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242596Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:16.073{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242595Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:16.073{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73DEFC229CFAC645D78E308ECC0CBCD9,SHA256=D52C170604E22F85AE43BA39E55B857EE3031A87EDD710EDCC82E02A946E50FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242599Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:17.077{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242598Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:17.077{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06EC3DBF6C810FE9FA02996EA96B2FB1,SHA256=5B6782FE3994922C527FF36C258EBE3DDF532C219EA7BC21BFFC39B570F317BC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242601Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:18.087{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242600Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:18.087{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E04CB78CB554F6F3D409237EF7C2CF16,SHA256=93285D81A203360BADFC0C964CEAA6D514FE067141E3B5DFE04FCA9D374708CB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242603Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:19.093{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242602Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:19.093{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5237670CD1C261F878F94ACC10CE0F82,SHA256=C161276F82AF714E0215A2E0AA50E8E7E4D82E3DFFA51AF47FC7879E2D81320E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242605Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:20.196{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242604Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:20.196{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1A601D533048EF94E434F3940032EE2,SHA256=CDB6B342604C83AD5E1C106C9C51C1CABDEE77B68E8DD99A9DDE7C54C721251A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242607Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:21.299{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242606Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:21.299{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=34202B8B58EC496853ED6E7FFD07D938,SHA256=2E28FCBFF6611CA813EE8C73F6C7A59BC4810ABD9323F74906F45071D0D6D7A9,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242612Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:19.539{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57789-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242611Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:22.308{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242610Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:22.307{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD322E5D7A94F89D441B4C996BE4D72A,SHA256=EF594226F9195C65910F47555F53D3E391429425E8305CBB7C4BF72938EBDB11,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242609Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:22.236{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000242608Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:22.236{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=A03574B5C5AD20B2921118E2FECC8F89,SHA256=F1681E78856D0441E3FBC6055D4BF23FADEA0A3B9012D159A2BCC3CE3F613415,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242614Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:23.412{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242613Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:23.412{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EF0600977EC06FE03AE34BA6CB8D861,SHA256=36CA2C98A2A8093B2FB620C7E09935C8FDFC22456360094841FE95F95CA65650,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242616Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:24.518{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242615Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:24.517{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2006020252C3C394DBFFCC173A59C239,SHA256=3DF4F154AC6C6FF470D23AF793CE6B9B5CC284679123ABCC501EAF5DB0FC98B6,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242618Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:25.622{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242617Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:25.622{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3ADD5528C38C501E7855086FCF4CBB1D,SHA256=B74844FC39ADC7ED89695B2A0049ED1C470722938D841938C1B03DC8FAADF6EF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242621Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:26.627{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242620Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:26.627{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=843DA2498ED38B516974275388696A79,SHA256=D64B0298E65A40E8D7483DABBBEAF80382AA9221B6415165C85AA7D1EC62BC78,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242619Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:26.110{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:15:26.110 11241100x8000000000000000242623Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:27.730{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242622Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:27.729{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=43C54249C4D6F2406975BB43D5880D8A,SHA256=F49C5D2F91EA918DCBEE359AE527CFA522310FBF5ED7F498589EDBC1E8729D1D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242626Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:28.737{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242625Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:28.737{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A75EB747FFFAF330FB21E1D5E44BE6CB,SHA256=DF3B777730474CD684548316BD07693F5380BC8B310D848E95CE7950918032C8,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242624Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:24.644{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57790-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 23542300x8000000000000000242637Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.893{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=78F9F0082061DC1A39FEA26112F6AB3E,SHA256=2780B968258C03E21A05CA2E56CD64867B1C319716421F023FF4EC56264F8A03,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242636Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.844{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242635Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.844{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=675BE10CF740FE0FE2F176CDE03E75FD,SHA256=216BA1BF6B0565D0EC2181C36431C7EFB0097CED1BCA38EF6F0E7AF34A62934E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242634Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.514{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2391-6260-C502-000000004402}5044C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242633Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.509{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242632Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.509{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242631Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.508{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242630Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.508{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242629Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.508{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2391-6260-C502-000000004402}5044C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242628Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.508{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2391-6260-C502-000000004402}5044C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242627Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:29.507{8D845A55-2391-6260-C502-000000004402}5044C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000242660Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.888{8D845A55-2392-6260-C702-000000004402}59602480C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242659Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.855{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242658Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.855{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB3BE951327B964BA59E563DC7E290AD,SHA256=BEBFE83B0C588D90226C2327B80F5B368A2C1497232D53CBCF2E94196B8C40A3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242657Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.671{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2392-6260-C702-000000004402}5960C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242656Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.669{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242655Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.669{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242654Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.669{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242653Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.668{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242652Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.668{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-2392-6260-C702-000000004402}5960C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242651Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.668{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2392-6260-C702-000000004402}5960C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242650Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.668{8D845A55-2392-6260-C702-000000004402}5960C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x8000000000000000242649Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:27.711{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local57791-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000242648Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:27.711{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local57791-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 11241100x8000000000000000242647Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.446{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000242646Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.446{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=377A407B178221DCA9F42B8850A3C564,SHA256=7FC09A979BFC972CCB2B1CDE217E5771D43DDEF0771623340D112C8C3959B2DE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242645Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.153{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2392-6260-C602-000000004402}5336C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242644Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.151{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242643Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.151{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242642Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.151{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242641Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.151{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242640Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.151{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2392-6260-C602-000000004402}5336C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242639Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.150{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2392-6260-C602-000000004402}5336C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242638Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.150{8D845A55-2392-6260-C602-000000004402}5336C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242662Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:31.958{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242661Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:31.958{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=391DE6F79B3E89EBE23597095C6841BE,SHA256=B41183B8551ABE1D4069A09930C2B2F57E73AE43BD87C62B52BBE8152B16104E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242680Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.745{8D845A55-2394-6260-C902-000000004402}46762592C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242679Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.572{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2394-6260-C902-000000004402}4676C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242678Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.571{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242677Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.571{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242676Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.570{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242675Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.570{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242674Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.570{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-2394-6260-C902-000000004402}4676C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242673Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.570{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2394-6260-C902-000000004402}4676C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242672Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.570{8D845A55-2394-6260-C902-000000004402}4676C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000242671Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.251{8D845A55-2394-6260-C802-000000004402}12604904C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242670Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.079{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2394-6260-C802-000000004402}1260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242669Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.077{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242668Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.077{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242667Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.076{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242666Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.076{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242665Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.076{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-2394-6260-C802-000000004402}1260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242664Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.076{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2394-6260-C802-000000004402}1260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242663Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:32.076{8D845A55-2394-6260-C802-000000004402}1260C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000242700Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.779{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2395-6260-CB02-000000004402}4332C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242699Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.777{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242698Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.777{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242697Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.777{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242696Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.777{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242695Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.777{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2395-6260-CB02-000000004402}4332C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242694Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.777{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2395-6260-CB02-000000004402}4332C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242693Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.777{8D845A55-2395-6260-CB02-000000004402}4332C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x8000000000000000242692Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:30.505{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57792-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 10341000x8000000000000000242691Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.333{8D845A55-2395-6260-CA02-000000004402}23484104C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+610325|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60fe56|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60943|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+9e7f20|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242690Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.099{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2395-6260-CA02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242689Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.097{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242688Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.096{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242687Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.096{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242686Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.096{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242685Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.096{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2395-6260-CA02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242684Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.096{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2395-6260-CA02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242683Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.095{8D845A55-2395-6260-CA02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242682Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.072{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242681Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:33.072{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4C6AF56B59392ADE67B1158AB3DA6FC5,SHA256=80DE62482966670B7CDDA1EFD6E5463CC815DDCE90415611D7589A952D8F0322,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242704Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:34.183{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242703Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:34.182{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=798431EC99EBA889A5B934598EE619B5,SHA256=E831788E897DD24B05D40F600A894D3FBBCC3966E4884397D9DEE687DF36CDA0,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242702Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:34.078{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000242701Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:34.077{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=D0A809E82D986188707E46746C5D8FF6,SHA256=C2CDECC9298673CBA7B49687F5D57AE85B760A8D0FDDC7D3F71AC0AE11D09670,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242706Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:35.287{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242705Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:35.287{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E94D7E6CC0502A1131ADF9CE2564DA3,SHA256=7ED948432C662974CDFC5EE1EC3F72131EFB992459FA04C2031864516A30B60A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242708Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:36.291{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242707Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:36.291{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=45BD3313B7E1A1CFFABBEE6D2161B82F,SHA256=ED325FEA00D0A714C395601A761CE2A487CB383B54651E2BDE2A47614E4FB9BD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242710Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:37.297{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242709Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:37.296{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18E60B07B3E7A330F2D75D52740757EF,SHA256=475A93F0313B04EE9898167E7F9D556FBCF5324EC64BE7030234D5A67EF20621,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242713Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:35.522{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57793-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242712Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:38.304{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242711Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:38.304{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C517F067145F10284A6E58457826D077,SHA256=43EAC8653D96C23DA41B8CD55DD5233F45095BEF91D630257430757AAD35F494,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242715Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:39.308{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242714Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:39.308{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8ED74A300AEFB59250B2E11CF1184008,SHA256=F626DDD80F8F770CAE152073ECF0DAD33A5AF48B2FB8628544AD51E96393A51C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242717Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:40.312{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242716Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:40.312{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39B0343B90F1BE1EF45CA8E39E3F8269,SHA256=1361737F285E05033DFB734201B106122513474BF60E5C79E84D9C5FA9B66878,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242719Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:41.417{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242718Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:41.417{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A874AA7BF3375730A07A5BEA2E9D2B7,SHA256=703676615F1E51713F3C97055BDFE9BD745FC2D38E6FF5151F89E62C534D8C03,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242721Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:42.524{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242720Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:42.524{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E4725D10B863457BE61B3F99BD11E11,SHA256=513914300C02EE3EFD1BB81F030E8A208020CF799384CEC8AE39ABADEF32BDF2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242723Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:43.628{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242722Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:43.628{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=30087B4893EF4978D11E1310F1C9A359,SHA256=232ABBBE148131A1F810500B56D2F45497B630324D7632DE5D62D5B8E77258F5,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242729Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:41.444{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57794-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242728Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:44.734{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242727Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:44.734{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=994C9EB4DB7C45DB053694346595341B,SHA256=7732964CE0C2EAD0D0CB4C4AAD636BF614A25E08A5382F4EE9AAB6782F9174A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242726Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:44.446{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\respondent-20220420141616-057MD5=8D93873C901538A8B2B909297EDAE7BB,SHA256=9423023AAA5D37B26F7EE3576993D2852CE2F95EF8E5E497C042A8474DDD26FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242725Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:44.445{8D845A55-15B0-6260-4700-000000004402}3580C:\Program Files\Amazon\SSM\ssm-agent-worker.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\respondent-20220420141616-0572022-04-20 15:15:44.444 11241100x8000000000000000242724Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:44.443{8D845A55-15AE-6260-2D00-000000004402}2972C:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\surveyor-20220420141614-0582022-04-20 15:15:44.443 11241100x8000000000000000242739Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.841{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242738Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.841{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0404D4498F2949A2293238EC7668F94E,SHA256=D6CE5E84766D77DE5B8220E38C7B359BF9B0BCE8DA3A8CD599B5D3659EE61B5F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242737Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.445{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\surveyor-20220420141614-058MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242736Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.388{8D845A55-15DF-6260-9400-000000004402}43241136C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242735Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.388{8D845A55-15DF-6260-9400-000000004402}43241136C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242734Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.388{8D845A55-15DF-6260-9400-000000004402}43241136C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242733Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.380{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242732Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.380{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242731Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.379{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242730Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:45.379{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242741Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:46.945{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242740Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:46.944{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=570C0CD33893A92C4ECAE392C3F1E8BB,SHA256=6851DAFE1F094CCBA675EA03D24765B85671A3EE41B2F59051F473803FEC4E35,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242743Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:47.954{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242742Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:47.953{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31FBD5EC2C09A5EB9ABFC5692B48AB2E,SHA256=ADFE897D9C2557488D5C862EC2D74D0B548E471FD229E7B8DA79AF9470E5BBA7,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242746Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:46.532{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57795-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242745Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:49.057{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242744Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:49.057{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61F8597E96A525F5CE74C5BBD9878686,SHA256=AB44907464C38BDE7BB80216BEA4134BEEDC830D9BD7045A2903F77C2E40A1FA,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242748Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:50.061{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242747Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:50.061{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6346BA105F45CC85A245606C170A8CB,SHA256=348B8E7FE06F7AED094CCBD00B24B36F8C68C1A86FBD6FFEC925E94E0CBEA0FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242750Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:51.165{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242749Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:51.164{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6746E47ED287499C7E94F7714A974DAD,SHA256=0BD7B47C52ADCF0AE98B9F83780FCEF50810D79A2054B4F5421A31F429216FA2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242752Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:52.267{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242751Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:52.267{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31E2EF12E97DBC98C3C40AE55249D93F,SHA256=A10B5A37C9CE1C7E51AA200833A1E3E68CA5B19FDD7344A43AD07E90027068E0,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242757Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:53.374{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242756Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:53.374{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69EB271461A2AB4959B9FD938A523E64,SHA256=4C36CAEA686E077D0F99A79912CF7A04EE9D0E4542A64BCD507AF6A7FF1B0E53,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242755Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:53.268{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exeC:\Users\Administrator\AppData\Roaming\Notepad++\session.xml2022-04-14 17:01:56.838 23542300x8000000000000000242754Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:53.266{8D845A55-1E68-6260-1002-000000004402}5452ATTACKRANGE\AdministratorC:\Program Files\Notepad++\notepad++.exeC:\Users\Administrator\AppData\Roaming\Notepad++\session.xmlMD5=E87A54C46F90F3AA0FE6A7B828DD9E83,SHA256=0B7563811A942F9C5F45F95B17188E2C65D2464BD2D5353FEFC351BF683AA7AB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242753Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:53.259{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exeC:\Users\Administrator\AppData\Roaming\Notepad++\backup\AttackRangeSysmon.xml@2022-04-20_1515532022-04-20 15:15:53.257 354300x8000000000000000242763Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:51.570{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57796-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 23542300x8000000000000000242762Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:54.786{8D845A55-1E68-6260-1002-000000004402}5452ATTACKRANGE\AdministratorC:\Program Files\Notepad++\notepad++.exeC:\Users\Administrator\AppData\Roaming\Notepad++\backup\AttackRangeSysmon.xml@2022-04-20_151553MD5=C9C79AAAA9E328BADBE4D3F5DBCF2467,SHA256=E88B67FE7E0B301DCC71EFBF3C981474FECCC9AF36DF79A1D27551A7234CD11C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242761Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:54.777{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exeC:\Program Files\ansible\AttackRangeSysmon.xml2022-04-12 13:18:48.382 23542300x8000000000000000242760Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:54.775{8D845A55-1E68-6260-1002-000000004402}5452ATTACKRANGE\AdministratorC:\Program Files\Notepad++\notepad++.exeC:\Program Files\ansible\AttackRangeSysmon.xmlMD5=86A70F47C1D6386773C1D7082A615531,SHA256=661B26866D0D952938F1C0DE4EB9F257733E3EB2557954226CF51E5B18DD68DB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242759Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:54.477{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242758Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:54.477{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8EF5647C5E8270779CEA4A548965F6EE,SHA256=3A320C91FB9685A98525D632DD98565F9B4F68FDDF047319699D8573C1605638,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242765Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:55.581{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242764Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:55.580{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C0A5F7737AB52B171769DA8189B9FC5A,SHA256=CCAED37C8AE8780A26A69241BD8064A9C8C28D1499B8BA3CE28457A8AF20EF66,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242768Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:56.586{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242767Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:56.586{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=146DE3DA2D7F75935091BA8D83F03E1A,SHA256=9F0E923158E08CDE2FCC9504304076F47635DDD40B82BA1E6249281CB9823667,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242766Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:56.095{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:15:56.095 11241100x8000000000000000242770Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:57.590{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242769Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:57.590{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8585ECE1E139CE62BB8AFFEE642449D9,SHA256=04493AE3FE368FED41E641F66D90AEF36633F3C1C487DC596626FF8B14F50157,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242772Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:58.696{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242771Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:58.696{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7343A92B58D93D69C98FB0D23C700898,SHA256=2FDB1B05C61D99566E8E6AE10DB11E899E186E6D931A2557F3CBC4270E697450,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242798Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:56.579{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57797-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242797Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.708{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242796Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.708{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85C980D0A76CF275E347CB05E365C707,SHA256=94704BD367C1515FE692C9DE7651AD515957962B576BC79EC7804E84A6209DA7,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000242795Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.371{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\DhcpConnForceBroadcastFlagDWORD (0x00000000) 13241300x8000000000000000242794Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.371{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\IsServerNapAwareDWORD (0x00000000) 13241300x8000000000000000242793Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.371{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\AddressTypeDWORD (0x00000000) 13241300x8000000000000000242792Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.371{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\LeaseTerminatesTimeDWORD (0x626031bf) 13241300x8000000000000000242791Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.371{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\T2DWORD (0x62602ffd) 13241300x8000000000000000242790Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.370{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\T1DWORD (0x62602ab7) 13241300x8000000000000000242789Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.370{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\LeaseObtainedTimeDWORD (0x626023af) 13241300x8000000000000000242788Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.370{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\LeaseDWORD (0x00000e10) 13241300x8000000000000000242787Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.370{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\DhcpServer10.0.1.1 13241300x8000000000000000242786Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.370{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\DhcpSubnetMask255.255.255.0 13241300x8000000000000000242785Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.370{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\DhcpIPAddress10.0.1.14 13241300x8000000000000000242784Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:15:59.370{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98e45835-fba7-4920-958b-0f78d830015f}\DhcpInterfaceOptionsBinary Data 11241100x8000000000000000242783Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.281{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat2022-04-20 14:15:57.498 23542300x8000000000000000242782Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.280{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=022DDAC32D00C03EF5298C5450D9D222,SHA256=31295D5B79BF4936AF26C2A5FF6D05B5F0C6DE2872DD28EDE59EA47C2696375B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242781Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.226{8D845A55-159D-6260-1600-000000004402}12925376C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2a2f2|C:\Windows\system32\wbem\wmiprvsd.dll+29e26|C:\Windows\system32\wbem\wmiprvsd.dll+28432|C:\Windows\system32\wbem\wmiprvsd.dll+57817|C:\Windows\system32\wbem\wmiprvsd.dll+8a475|C:\Windows\system32\wbem\wbemcore.dll+bcb3|C:\Windows\system32\wbem\wbemcore.dll+3393|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+2c9be|C:\Windows\system32\wbem\wbemcore.dll+202d8|C:\Windows\system32\wbem\wbemcore.dll+390e|C:\Windows\system32\wbem\wbemcore.dll+22bba|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242780Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.226{8D845A55-159D-6260-1600-000000004402}12925376C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\wbem\wmiprvsd.dll+2597b|C:\Windows\system32\wbem\wmiprvsd.dll+283dc|C:\Windows\system32\wbem\wmiprvsd.dll+57817|C:\Windows\system32\wbem\wmiprvsd.dll+8a475|C:\Windows\system32\wbem\wbemcore.dll+bcb3|C:\Windows\system32\wbem\wbemcore.dll+3393|C:\Windows\system32\wbem\wbemcore.dll+22adf|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+2c9be|C:\Windows\system32\wbem\wbemcore.dll+202d8|C:\Windows\system32\wbem\wbemcore.dll+390e|C:\Windows\system32\wbem\wbemcore.dll+22bba|C:\Windows\system32\wbem\wbemcore.dll+22a19|C:\Windows\system32\wbem\wbemcore.dll+21f5a|C:\Windows\system32\wbem\wbemcore.dll+22711|C:\Windows\system32\wbem\wbemcore.dll+2d78c|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242779Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.175{8D845A55-15DF-6260-9400-000000004402}43245856C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242778Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.175{8D845A55-15DF-6260-9400-000000004402}43245856C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242777Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.175{8D845A55-15DF-6260-9400-000000004402}43245856C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242776Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.171{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242775Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.170{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242774Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.170{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242773Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.170{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242804Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:00.815{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242803Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:00.814{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5BD8676F5ECC8EEC00306CB911F0326,SHA256=2BBBB57445A114DBEE431BECC049A0A645D6638CAA73C65BBD3EF39D0133B9FE,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242802Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:57.783{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local68bootpcfalse10.0.1.1ip-10-0-1-1.us-east-2.compute.internal67bootps 10341000x8000000000000000242801Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:00.392{8D845A55-159B-6260-0B00-000000004402}636684C:\Windows\system32\lsass.exe{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242800Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:00.390{8D845A55-159B-6260-0B00-000000004402}636684C:\Windows\system32\lsass.exe{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 23542300x8000000000000000242799Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:00.093{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=07753B21E3A9B59FBDC2BA48388122AC,SHA256=50861D0E29BB712387107D9D8B7923D688AC414E89667951FC4F4ACAA3A83202,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242820Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:01.924{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242819Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:01.924{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB6F6DFEA8BA0B0AEB738E6ABA84F378,SHA256=3A5F4C620C2CF06147594A652609CDD38B5ED6935ECC99E1F59ED930A37B4F58,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000242818Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\RegisteredSinceBootDWORD (0x00000001) 13241300x8000000000000000242817Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\StaleAdapterDWORD (0x00000000) 13241300x8000000000000000242816Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\CompartmentIdDWORD (0x00000001) 13241300x8000000000000000242815Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\FlagsDWORD (0x00000002) 13241300x8000000000000000242814Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\TtlDWORD (0x000004b0) 13241300x8000000000000000242813Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\SentPriUpdateToIpBinary Data 13241300x8000000000000000242812Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\SentUpdateToIpBinary Data 13241300x8000000000000000242811Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\DnsServersBinary Data 13241300x8000000000000000242810Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\HostAddrsBinary Data 13241300x8000000000000000242809Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\PrimaryDomainNameattackrange.local 13241300x8000000000000000242808Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\AdapterDomainName(Empty) 13241300x8000000000000000242807Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.402{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\Hostnamewin-dc-ctus-attack-range-355 10341000x8000000000000000242806Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:01.393{8D845A55-159B-6260-0B00-000000004402}636684C:\Windows\system32\lsass.exe{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+97022|C:\Windows\system32\kerberos.DLL+794d4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2f1f1|C:\Windows\system32\lsasrv.dll+2d0d6|C:\Windows\system32\lsasrv.dll+32475|C:\Windows\system32\lsasrv.dll+302fb|C:\Windows\system32\lsasrv.dll+2f1f1|C:\Windows\system32\lsasrv.dll+1752d|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e 13241300x8000000000000000242805Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:01.390{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{98E45835-FBA7-4920-958B-0F78D830015F}\RegisteredSinceBootDWORD (0x00000001) 354300x8000000000000000242844Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.817{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domainfalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57854- 354300x8000000000000000242843Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.816{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local65535-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domain 354300x8000000000000000242842Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.816{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetruea00:10e:0:0:9890:5ff5:cd7:ffff-65535-truea00:10e:4424:584d:85c0:740f:488b:d45-53domain 354300x8000000000000000242841Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.816{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56147- 354300x8000000000000000242840Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.815{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56622- 354300x8000000000000000242839Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.815{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56622-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domain 354300x8000000000000000242838Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.815{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local57512- 354300x8000000000000000242837Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.810{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56167-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000242836Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.810{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56167-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000242835Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.809{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domainfalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local65535- 354300x8000000000000000242834Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.807{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56166-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domain 354300x8000000000000000242833Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.807{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56166-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domain 354300x8000000000000000242832Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.805{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domainfalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local55979- 354300x8000000000000000242831Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:15:59.805{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local55979-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domain 10341000x8000000000000000242830Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.634{8D845A55-15DF-6260-9400-000000004402}43245856C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4102-000000004402}368C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242829Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.634{8D845A55-15DF-6260-9400-000000004402}43245856C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4102-000000004402}368C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242828Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.634{8D845A55-15DF-6260-9400-000000004402}43245856C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4102-000000004402}368C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242827Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.629{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4202-000000004402}4852C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242826Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.629{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4202-000000004402}4852C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242825Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.629{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4202-000000004402}4852C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242824Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.629{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4202-000000004402}4852C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242823Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.433{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000242822Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.432{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B8FB62CF1F8BE78C834D2ED56B9113EC,SHA256=324B1BC9EA62CA268AFFD763890CCA8073BAEBDC58037A894159998585549A26,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242821Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:02.246{8D845A55-159B-6260-0B00-000000004402}636684C:\Windows\system32\lsass.exe{8D845A55-1596-6260-0100-000000004402}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+97022|C:\Windows\system32\kerberos.DLL+794d4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2f1f1|C:\Windows\system32\lsasrv.dll+2d0d6|C:\Windows\system32\lsasrv.dll+32919|C:\Windows\system32\lsasrv.dll+30267|C:\Windows\system32\lsasrv.dll+2f1f1|C:\Windows\system32\lsasrv.dll+1752d|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e 354300x8000000000000000242850Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:00.659{8D845A55-1596-6260-0100-000000004402}4SystemNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56168-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local445microsoft-ds 354300x8000000000000000242849Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:00.659{8D845A55-1596-6260-0100-000000004402}4SystemNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56168-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local445microsoft-ds 11241100x8000000000000000242848Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:03.289{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000242847Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:03.288{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242846Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:03.035{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242845Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:03.034{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5A6975E8AE2045096D8447EF5C42C48,SHA256=8387D0CD9CE2E3F81C4B49EA25FDFF2C0A6B9D3B625E620B579FADA0DCD93194,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242877Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.140{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242876Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.140{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B32E25CFF059C1A1225AD750E2395FCC,SHA256=6B0A8258B43511C9D3DF2C0A62A6ABEEF5BCEF0B759008A474CCD106D92F880A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242875Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.100{8D845A55-1596-6260-0100-000000004402}4SystemC:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSysmonDnsEtwSession.etl2022-04-20 14:16:14.682 11241100x8000000000000000242874Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.099{8D845A55-1596-6260-0100-000000004402}4SystemC:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSYSMON TRACE.etl2022-04-20 14:16:14.681 11241100x8000000000000000242873Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.097{8D845A55-1596-6260-0100-000000004402}4SystemC:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSysmonDnsEtwSession.etl2022-04-20 14:16:14.682 13241300x8000000000000000242872Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:04.080{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHashSHA256=FA39A46562A507323D8AD7F29A48D452FC707DCCF4DE3693C28040735B8F6B28 13241300x8000000000000000242871Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:04.080{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigFileC:\Program Files\ansible\AttackRangeSysmon.xml 16341600x8000000000000000242870Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local2022-04-20 15:16:04.080C:\Program Files\ansible\AttackRangeSysmon.xmlSHA256=FA39A46562A507323D8AD7F29A48D452FC707DCCF4DE3693C28040735B8F6B28 13241300x8000000000000000242869Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:04.078{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\RulesBinary Data 13241300x8000000000000000242868Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:04.078{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\DnsLookupBinary Data 13241300x8000000000000000242867Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:04.078{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\CheckRevocationBinary Data 13241300x8000000000000000242866Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:04.078{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\HashingAlgorithmDWORD (0x8000000e) 13241300x8000000000000000242865Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:04.078{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\OptionsDWORD (0x00000007) 12241200x8000000000000000242864Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:16:04.078{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\Rules 12241200x8000000000000000242863Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:16:04.077{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\DnsLookup 12241200x8000000000000000242862Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:16:04.077{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\CheckRevocation 12241200x8000000000000000242861Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:16:04.077{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\HashingAlgorithm 12241200x8000000000000000242860Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:16:04.077{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\Options 10341000x8000000000000000242859Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.076{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242858Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.028{8D845A55-1F6C-6260-4202-000000004402}48525432C:\Windows\system32\conhost.exe{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242857Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.026{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242856Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.025{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242855Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.025{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242854Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.025{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242853Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.024{8D845A55-15B0-6260-4F00-000000004402}38202388C:\Windows\system32\csrss.exe{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242852Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.024{8D845A55-1F6C-6260-4102-000000004402}368608C:\Windows\system32\cmd.exe{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+1ace3|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242851Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:04.024{8D845A55-23B4-6260-CC02-000000004402}4440C:\Program Files\ansible\sysmon\Sysmon64.exe13.01System activity monitorSysinternals SysmonSysinternals - www.sysinternals.com-Sysmon64.exe -c "C:\Program Files\ansible\AttackRangeSysmon.xml"C:\Program Files\ansible\sysmon\ATTACKRANGE\Administrator{8D845A55-15DE-6260-DFBE-070000000000}0x7bedf2HighMD5=8A914CFB7496B8461285C009DD8F5627,SHA256=422EC998FED690C2EC3239A4BB80075F098A9A95CBDFFBC873365B9F7136A02A,IMPHASH=DCF866F4139DD7FF6C0A5D4FA050CD7A{8D845A55-1F6C-6260-4102-000000004402}368C:\Windows\System32\cmd.exe"cmd.exe" /s /k pushd "C:\Program Files\ansible\sysmon" 11241100x8000000000000000242879Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:05.148{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242878Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:05.148{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=59F174D1B9C92F61774745642FE9FCBD,SHA256=96FEE5357C1B6314FEFB621E8D4B30BB476D7CE4617BF3576B3E2AE3013E0A0E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242881Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:06.251{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242880Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:06.251{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B46BE97B4444A0917EEA2570E01BECD4,SHA256=0CE85F181BEE75ED5E048ACF78437669D3B568727C42919CE022AD47465ED9ED,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242883Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:07.354{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242882Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:07.354{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB072C1CCDA8CF04F466F8FE13CF4804,SHA256=C908EFBC4EBF42EB474635DB2EF64233E83511B555CEFD303BDF250457A10A9F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242885Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:08.462{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242884Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:08.461{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7B9A5F1347B35E91A5D39206FB89A229,SHA256=B903E5DFCEFB4B3D30060EDD3A1E4C973703A18997D36A0C192A0C20D0CAF559,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242887Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:09.568{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242886Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:09.567{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=323EF3C482428F6E42C360995F919322,SHA256=C8D4BFC1C53D452CD54053356FF039C56DF3F2BB9A18185CE3843BE49002EF9B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242890Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:10.675{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242889Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:10.674{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E19E4F98B7E63FF4BEDB648E65FA31AE,SHA256=C6A4CE09C6671D147D90F6F28F64294E4772D4CE39426F4D21020041B9A58A3E,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242888Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:07.467{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56171-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242894Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:11.679{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242893Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:11.678{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B0A833F5046B42B79FD4BEE2FD3B1094,SHA256=933C1E6CEAF113ABAC912CE551DEF12A49C1C95A22E8C101A2666404D8592517,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242892Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:11.496{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000242891Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:11.496{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=EBD240DDE5A46A174910800CAF1455DD,SHA256=68013760ACA877BAED8C2ABC73E29508613E7E627567FD13B728BC3BFC63DEDD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242896Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:12.782{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242895Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:12.782{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78C54ADD9ED9B342515A4C211BE89E2F,SHA256=75CCCD3C4BF232504FE46497823685DF05990AC681D5E44F29935D56F1F3EDC4,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242898Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:13.886{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242897Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:13.886{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9A7DB8DFB357160FDD99B0DC0E64697D,SHA256=45E17EE702AFBB146156427770AE3E8A1D42E2B297BBD161FC1DFC4EA8E91CC7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242902Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:14.993{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242901Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:14.993{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1DB0AF54D9BA29007B0C147615388960,SHA256=4186D0145D594320BC037AD0443C160DE63897819B9C781BCB34B7FE10F4C7E2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242900Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:14.060{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000242899Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:14.060{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9C6245E91553042AD852E337AA3CED20,SHA256=0C3A22DC5C8266FD042F8ADB09C966069F66A42E59FFE16EF311D7662AC828CE,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242903Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:12.497{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56172-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242905Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:16.097{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242904Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:16.097{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B1391A6317963A91D6D6B44AAEF85880,SHA256=CE5C800B3698A3529976A9AD996E90B9AA0C8BECB35CE0CB2DEC0CDB6CFBE192,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000242908Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:17.371{8D845A55-159D-6260-1200-000000004402}504C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d854c9-0x95141d55) 11241100x8000000000000000242907Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:17.201{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242906Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:17.201{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2BCFB33CA6DBBDD23BA0604F51696722,SHA256=4034F18C3A76C143E291A275C0B1CDF2F09B693F0ABC0A629F9DA5CE8BBD5536,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242912Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:18.458{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\System2022-04-12 13:19:12.126 23542300x8000000000000000242911Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:18.458{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=E4FA13254023D5888E5EBF8F5AA75177,SHA256=90D83E2011994920285B786682F774C42053DF6AAF8C055065E8F9528EBAAE76,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242910Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:18.207{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242909Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:18.207{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ABF7B9A57E7E8FA54A24E9B572D46C2F,SHA256=E5D9B6F52C92DC69737611A11C55F3ABBAED572EC84BDC44602CFA52BCF116E6,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242915Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:15.783{8D845A55-159D-6260-1200-000000004402}504C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local123ntpfalse169.254.169.123-123ntp 11241100x8000000000000000242914Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:19.311{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242913Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:19.311{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C6B3FDA2FAA072C9343AF632993A957,SHA256=4D14B09C1FFB505EE5E32FC546FCAF9A9002000FF7EB0B14DA13CBBD5615EB2F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242917Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:20.417{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242916Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:20.417{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A6D1F91FF798349687EE9302383C988,SHA256=6BD965C16FE6A137E06DD1A641BCC8F8470E76032B59536DEB4689759D772F58,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242922Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:21.522{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242921Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:21.522{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B43DBDFB5659CAB15F5109DB1E89B31C,SHA256=793995315DC032528293F204A5331A31E637E6A72AB84B532B5529DEC8EFE853,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242920Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:21.514{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000242919Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:21.514{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=8EC7CEC9E7ED6FAC56EBE151FF3D2886,SHA256=13100D41D67DF011B2DC0AE5E8D9C0AD762238C15C7DEF2A032993EE81DDED8F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242918Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:17.621{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56173-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242924Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:22.529{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242923Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:22.529{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=59DD924782F8271AE0C5FED4E1862912,SHA256=70D6B58770B9984125EE47B439B8D9B6AFFBF20093BFC1C5407BD1475CBAB0C9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242926Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:23.536{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242925Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:23.535{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FDFEFA349D3FB964FEF222CA91B41347,SHA256=309B7B89C1594B72C2BCFA79903CABCFE6F83F50A8DA4C9925BEBE1F07A2BACA,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242928Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:24.540{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242927Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:24.540{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1DE664B4B364DCCDFE167CD40399413B,SHA256=1A23062F5A2E4CCEDD2D4EC62750911AB0D371A85613DB19F7280CE6CBF35A9B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242930Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:25.546{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242929Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:25.545{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FC74D63E9DB647429969F9574E19DB44,SHA256=0FE4A7D49261FEBDA5393A09B60FBC4B5E581F753B998ACE5E4667D4439F8614,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242940Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.651{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242939Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.651{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6C688FEE96DD123409395B4161F4946,SHA256=B75425D0664210C8441F796B81772EECB4D9A49DF82E33F6ADBE383017EAF1D6,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242938Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.312{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot\snap.dat2022-04-20 15:16:26.312 23542300x8000000000000000242937Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.311{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old\snap.datMD5=E6485ABB8082FCB74FFCFA081E95C0F6,SHA256=CFE5613D8CA7684E3397FBA58E44038D309A93706F08A4D8EE042C0FD10BB738,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242936Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.310{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old\btree_records.datMD5=AD67871BD2180BF80726CDA50283C0D0,SHA256=2BC8D6625A536F6F047E167265328A98367DB3E615DF568B9EA66F30D1839C72,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000242935Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.309{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old\btree_index.datMD5=54E5ACB41463046D68AFFC02F0AFCB5D,SHA256=ADC5AE7CC1B38B09EA024BCCA70650EAF0124392CA9BE1A37E398AEE58A24D31,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242934Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.307{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.tmp\btree_records.dat2022-04-20 15:16:26.307 11241100x8000000000000000242933Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.307{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.tmp\btree_index.dat2022-04-20 15:16:26.307 11241100x8000000000000000242932Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.306{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.tmp2022-04-20 15:16:26.306 11241100x8000000000000000242931Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:26.104{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:16:26.104 11241100x8000000000000000242943Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:27.654{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242942Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:27.654{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C33605101D6576EC890EC0BD11A1D88,SHA256=2A1215DF7D9215445D7C4AE4892E2D56C392E1AD95001C530A84082150852138,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000242941Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:23.459{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56174-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000242945Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:28.759{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242944Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:28.759{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EA4F08510B0F1C0BC9F98E6165DFE86,SHA256=C657110D7F36AA64BEEE4F9FFE01CB6EE3137B3654E1499AD632D9E2A50A07BD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242957Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.869{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242956Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.868{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F93EBC2708B358A2861671A91EA85B9E,SHA256=6A4C5A1AD02D922D5F837CBD2704A86C139B0A57534CDB35CB411400EEF0BE7D,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000242955Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.703{8D845A55-23CD-6260-CD02-000000004402}4508C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe 10341000x8000000000000000242954Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.513{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-23CD-6260-CD02-000000004402}4508C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242953Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.511{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242952Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.511{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242951Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.510{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242950Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.510{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242949Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.510{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-23CD-6260-CD02-000000004402}4508C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242948Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.510{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-23CD-6260-CD02-000000004402}4508C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242947Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.510{8D845A55-23CD-6260-CD02-000000004402}4508C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000242946Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:29.303{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=C7A6313AA809935CA38174DF79A77105,SHA256=4281A0C589C01604AC4BDC06B60791190BD6E51D427195431C8C970F286D05B0,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000242979Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.980{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242978Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.980{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=882963CEF5611B209A158BC203E85E81,SHA256=912CA0679D89669950F9537BF86F3798CF1C440C1A4A6CF7FDD31A41C537A901,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000242977Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.842{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-23CE-6260-CF02-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242976Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.840{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242975Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.840{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242974Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.840{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242973Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.840{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242972Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.840{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-23CE-6260-CF02-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242971Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.840{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-23CE-6260-CF02-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242970Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.840{8D845A55-23CE-6260-CF02-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000242969Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.400{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000242968Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.398{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3EF39331655B8108BAFCB4AEA13C8F2D,SHA256=B81BFB645F48A0E3D54ABAA6A4D8C208B74D84021F8A04A9E764F0C589D4EF87,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000242967Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.378{8D845A55-23CE-6260-CE02-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe 10341000x8000000000000000242966Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.376{8D845A55-23CE-6260-CE02-000000004402}60401324C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242965Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.179{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-23CE-6260-CE02-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242964Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.178{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242963Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.178{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242962Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.177{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242961Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.177{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242960Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.177{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-23CE-6260-CE02-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242959Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.177{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-23CE-6260-CE02-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242958Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:30.176{8D845A55-23CE-6260-CE02-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000242990Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:31.956{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-23CF-6260-D002-000000004402}5016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242989Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:31.954{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242988Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:31.954{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242987Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:31.954{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242986Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:31.953{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242985Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:31.953{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-23CF-6260-D002-000000004402}5016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242984Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:31.953{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-23CF-6260-D002-000000004402}5016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242983Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:31.953{8D845A55-23CF-6260-D002-000000004402}5016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x8000000000000000242982Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:27.711{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56175-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000242981Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:27.711{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56175-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 534500x8000000000000000242980Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:31.022{8D845A55-23CE-6260-CF02-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe 534500x8000000000000000243005Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.827{8D845A55-23D0-6260-D102-000000004402}1912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 10341000x8000000000000000243004Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.826{8D845A55-23D0-6260-D102-000000004402}19124080C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243003Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.621{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-23D0-6260-D102-000000004402}1912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243002Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.620{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243001Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.619{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243000Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.619{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242999Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.619{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-23D0-6260-D102-000000004402}1912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000242998Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.619{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000242997Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.619{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-23D0-6260-D102-000000004402}1912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000242996Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.618{8D845A55-23D0-6260-D102-000000004402}1912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x8000000000000000242995Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:28.564{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56176-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 534500x8000000000000000242994Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.162{8D845A55-23CF-6260-D002-000000004402}5016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 10341000x8000000000000000242993Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.160{8D845A55-23CF-6260-D002-000000004402}50165640C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000242992Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.088{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000242991Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:32.088{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B3D341FACD7AF9CF01762525741C77B,SHA256=62B9789649C363DB4C6D1177410D65DC9A640A700111F97EFBC88FBB0C129E0E,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243031Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.979{8D845A55-23D1-6260-D302-000000004402}5208C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe 10341000x8000000000000000243030Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.782{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-23D1-6260-D302-000000004402}5208C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243029Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.780{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243028Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.780{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243027Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.780{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243026Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.780{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243025Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.780{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-23D1-6260-D302-000000004402}5208C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243024Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.780{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-23D1-6260-D302-000000004402}5208C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243023Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.779{8D845A55-23D1-6260-D302-000000004402}5208C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000243022Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.632{8D845A55-15DF-6260-9400-000000004402}43242492C:\Windows\Explorer.EXE{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+6497|C:\Windows\System32\SHCORE.dll+6387|C:\Windows\System32\SHCORE.dll+62fd|C:\Windows\System32\SHCORE.dll+620a|C:\Windows\System32\SHELL32.dll+af4a0|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9824|UNKNOWN(FFFFF800B9E62B58)|UNKNOWN(FFFFFDB12ECA5B88)|UNKNOWN(FFFFFDB12ECA5D07)|UNKNOWN(FFFFFDB12ECA0391)|UNKNOWN(FFFFFDB12ECA1D5A)|UNKNOWN(FFFFFDB12ECA0016)|UNKNOWN(FFFFF800B9B78503)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+b2cfb|C:\Windows\System32\SHELL32.dll+5360a|C:\Windows\System32\SHCORE.dll+33fad 10341000x8000000000000000243021Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.632{8D845A55-15DF-6260-9400-000000004402}43242492C:\Windows\Explorer.EXE{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+1c0e5|C:\Windows\System32\SHELL32.dll+aef81|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9824|UNKNOWN(FFFFF800B9E62B58)|UNKNOWN(FFFFFDB12ECA5B88)|UNKNOWN(FFFFFDB12ECA5D07)|UNKNOWN(FFFFFDB12ECA0391)|UNKNOWN(FFFFFDB12ECA1D5A)|UNKNOWN(FFFFFDB12ECA0016)|UNKNOWN(FFFFF800B9B78503)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+b2cfb|C:\Windows\System32\SHELL32.dll+5360a|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 23542300x8000000000000000243020Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.632{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF37958d.TMPMD5=DD8C29AAE0A45C3822ADE0E7CA84C037,SHA256=448C743772008F1A6623E6915E6111011845DFE3385A89996681D81E97DA526D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243019Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.630{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF37958d.TMP2022-04-20 15:16:33.630 11241100x8000000000000000243018Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.626{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9HQHJ3T0MXD2EPR8NYM3.temp2022-04-20 15:16:33.626 534500x8000000000000000243017Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.301{8D845A55-23D1-6260-D202-000000004402}3172C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe 10341000x8000000000000000243016Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.299{8D845A55-23D1-6260-D202-000000004402}31724696C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+610325|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60fe56|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60943|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+9e7f20|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243015Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.112{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-23D1-6260-D202-000000004402}3172C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243014Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.110{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243013Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.110{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243012Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.110{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-23D1-6260-D202-000000004402}3172C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243011Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.110{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243010Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.109{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-23D1-6260-D202-000000004402}3172C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243009Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.109{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243008Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.109{8D845A55-23D1-6260-D202-000000004402}3172C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243007Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.098{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243006Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:33.098{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7FD39E9CD5DD8E7B37372D38A2EEBD0,SHA256=00F3C9BF5FF9EFCCC527BEB77FC15C92AB170DF2038F1048D1ED62102BBA6827,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243035Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:34.628{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243034Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:34.627{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D13BA0AC90121AEFD259BFA45E0F9109,SHA256=1152C8BD028503FF2C35B714DFB98071DD47423B563A1150CD4C91C8765823BD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243033Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:34.615{8D845A55-159D-6260-0D00-000000004402}9005648C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-3000-000000004402}2368C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3d877|c:\windows\system32\rpcss.dll+29a97|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243032Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:34.615{8D845A55-159D-6260-0D00-000000004402}9005648C:\Windows\system32\svchost.exe{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3d877|c:\windows\system32\rpcss.dll+29a97|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243037Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:35.715{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243036Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:35.714{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83285A73009F1C141E268AED3990E43E,SHA256=CEFD7ADE080797DFE4AC855B609D8A28AD886C6D824F7520BC2710D700F834DF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243039Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:36.819{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243038Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:36.819{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E8AF97A36A0FDC26A2CBC445821281BA,SHA256=FF13261EDAD82F0BF9221733CE4A7985924837D1DF2900903DF0CC3CF90E1D0D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243042Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:37.923{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243041Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:37.923{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B50ADA6157DEDD030652FE87A52E247,SHA256=66C738B7130BF36940F11987F738B248E3DC2C86E7341D9A7C24AB8F247FB47E,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243040Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:34.539{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56177-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243044Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:39.025{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243043Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:39.025{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CE5B3579B8941A777AF223A9522790F9,SHA256=B548764E6B3BF07AF3864534B439C82FA79B84909A5AEE6374B0132C6F500F91,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243046Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:40.128{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243045Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:40.127{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F04C189BDA724EBC3A75A9C9E41B5BD5,SHA256=D7A67FBB4FEF92B5B9F02A354C9411E0CF4BB99BA80CCB053F8BDC0C4B5C0362,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243048Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:41.233{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243047Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:41.232{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A6D799DFBDB2975EBB71D3876BE5363,SHA256=90AA32C888CF76ACB6D96EC6316D67C6B5F7CE068502898F9D35ED96BD3EF142,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243050Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:42.237{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243049Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:42.237{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96E678DFA2A5ECD84C62F9CE2AEA137E,SHA256=E28619475A24109EC94A1730F3E0009A3FE6C14CAA6A2861ECF8C483B4366604,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243053Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:39.607{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56178-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243052Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:43.241{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243051Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:43.241{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E07596AAF331C8C33A59A525F2E8F437,SHA256=E1BCAB5830E548B9651601DF9E5D50AACB21180F6312E1EAF4FE66787EF08A41,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243055Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:44.245{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243054Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:44.245{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C716E009AE79311139FBE689677163C2,SHA256=40194F54692237F8B90494A0A1133B90458C9DA0889CBD93CF06BD081B651B43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243060Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.947{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\respondent-20220420141616-058MD5=8D93873C901538A8B2B909297EDAE7BB,SHA256=9423023AAA5D37B26F7EE3576993D2852CE2F95EF8E5E497C042A8474DDD26FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243059Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.945{8D845A55-15B0-6260-4700-000000004402}3580C:\Program Files\Amazon\SSM\ssm-agent-worker.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\respondent-20220420141616-0582022-04-20 15:16:45.945 11241100x8000000000000000243058Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.944{8D845A55-15AE-6260-2D00-000000004402}2972C:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\surveyor-20220420141614-0592022-04-20 15:16:45.944 11241100x8000000000000000243057Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.348{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243056Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.348{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E81542756004B07CE69A323A5B2D76B,SHA256=B66D1BEF8C0ACBBB5FB307479FC21D1D9BBFE7AB259D5EA25FB03D4CF305A423,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243063Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:46.945{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\surveyor-20220420141614-059MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243062Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:46.455{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243061Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:46.455{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=57710ED5EA905802001EC1CCF04E7632,SHA256=6E211949880651C6E4BEB985696D3B50241074281E58200F8282ADBD5CD85A69,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243072Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:47.561{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243071Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:47.561{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8F454F625CD56E8512BBE82D50CD450,SHA256=31463AD627DE8A90278B48DC56B0B5826EF8BAE6AFC9C5FC005A38B773A05DCE,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000243070Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:47.444{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\C415B540-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_C415B540-0000-0000-0000-100000000000.XML 11241100x8000000000000000243069Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:47.444{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeC:\System Volume Information\DFSR\Config\Volume_C415B540-0000-0000-0000-100000000000.XML.TMP2022-04-20 15:16:47.444 13241300x8000000000000000243068Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:47.442{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\34368782-AD18-41EA-9DBB-4DCA5018EFF5\Config SourceDWORD (0x00000001) 13241300x8000000000000000243067Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:16:47.442{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\34368782-AD18-41EA-9DBB-4DCA5018EFF5\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_34368782-AD18-41EA-9DBB-4DCA5018EFF5.XML 11241100x8000000000000000243066Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:47.441{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeC:\System Volume Information\DFSR\Config\Replica_34368782-AD18-41EA-9DBB-4DCA5018EFF5.XML.TMP2022-04-20 15:16:47.441 10341000x8000000000000000243065Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:47.430{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243064Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:47.429{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243080Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:48.668{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243079Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:48.668{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E1D268DE34EB5E3E8D2159ABD3CD8A15,SHA256=65D7CAE0A2B764F5CEE410299E4701EA2A22D9BB1D27D56A331C7157C37A00DD,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243078Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.848{8D845A55-159D-6260-0D00-000000004402}900C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56180-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local135epmap 354300x8000000000000000243077Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.848{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56180-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local135epmap 354300x8000000000000000243076Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.485{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56179-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 10341000x8000000000000000243075Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:48.273{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243074Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:48.270{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243073Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:48.270{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243091Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:49.674{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243090Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:49.674{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF59F7F0EBDAEFEE61A09F342293EE20,SHA256=3BD7D765064638960B8E60D39BAB591B475AAB4151BAC2400DAF1F5AFF808A1E,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243089Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.863{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetruea00:10e:0:0:9890:5ff5:cd7:ffff-65535-truee000:fc:0:0:0:0:0:0-5355llmnr 354300x8000000000000000243088Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:45.863{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local65535-trueff02:0:0:0:0:0:1:3-5355llmnr 11241100x8000000000000000243087Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:49.355{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000243086Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:49.355{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BC4085B00DA31DD1F96F19BD0AEBE0C2,SHA256=B9F3AD590F9679C66A2E38584781A64A9108F2C277FF188E12892F7CA03EEBBF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243085Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:49.276{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243084Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:49.276{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243083Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:49.102{8D845A55-159B-6260-0B00-000000004402}636684C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243082Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:49.099{8D845A55-159B-6260-0B00-000000004402}636684C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243081Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:49.099{8D845A55-159B-6260-0B00-000000004402}636684C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243097Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:50.682{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243096Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:50.682{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=718175D3C3700C09A597F8C80B4BE124,SHA256=CBF28353517AF1954DAA662E3D728224F0253F8521584B74973F8BBB30ED264B,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243095Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:47.513{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56182-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243094Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:47.513{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56182-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243093Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:46.684{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56181-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243092Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:46.684{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56181-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 11241100x8000000000000000243099Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:51.786{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243098Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:51.786{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A01B15018071DDD33DC013AE7420EEC3,SHA256=8939CC46EEDA53B4C0BCDD9D23903859C15A412EE7F3E56A1899C79C7F7E041C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243101Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:52.793{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243100Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:52.793{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=50ECCF73BF29CD1C637E1DFEE5F87D16,SHA256=58D885AD5CB7C4042FA883650EAA63EE2610DBCC9AB6FCB8639B202353BB7034,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243103Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:53.897{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243102Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:53.897{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=23EF69C1C15AE501EB4510E67D8D9F36,SHA256=716746E42F5F67D46ED88EE71C07C098B4FEEE55B29FBEBA300FD40A65AC149E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243145Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.610{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243144Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.610{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243143Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.610{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243142Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.610{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243141Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.610{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243140Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.610{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243139Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.610{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243138Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.610{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243137Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.610{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243136Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243135Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243134Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243133Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243132Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243131Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243130Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243129Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243128Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243127Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243126Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243125Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243124Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243123Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243122Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243121Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.609{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243120Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243119Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243118Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243117Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243116Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243115Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243114Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243113Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243112Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243111Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243110Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.608{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243109Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.607{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243108Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.607{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243107Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.607{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243106Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.607{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-3000-000000004402}2368C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243105Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:54.607{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-3000-000000004402}2368C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 354300x8000000000000000243104Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:50.559{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56183-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243147Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:55.489{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243146Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:55.487{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=346E580E85D904607F22B662420E44DD,SHA256=A38721C62BE7F3B39B4844C1BF7100F4BA36C4EE7574E340971E9B656EC376AE,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243150Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:56.520{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243149Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:56.520{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F114D0942DCE4E3219EB201C821E1488,SHA256=53249E2BC7F2D4E62FDE10853AAECD7F2F5D91069C8DE0578C2E38DEFF2D4693,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243148Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:56.097{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:16:56.097 11241100x8000000000000000243152Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:57.623{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243151Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:57.623{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9A97A8F14180CA1E330E003F48063F64,SHA256=0E83B9131A0012D06DA1DC91C791748F7B0B80B6252ED4770C634D3E19D0070F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243155Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:55.614{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56184-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243154Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:58.627{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243153Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:58.627{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=968A9CEA3E804D9A56DFA756A2CD3B8E,SHA256=F7206A5FB98C16CE03974F77E5F6BC74ACC69A6CD104BCF71B066A09A04B9C6B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243160Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:59.732{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243159Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:59.732{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BACFA9A2AFA6A2D087E645630ABB47C5,SHA256=C7EF6308792592C06C66F77555A061C3A5D315EB3AEE4C28E8EF86847EA2DC3B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243158Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:59.502{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=934206ED1DA1853B8267C64CFA7FBE92,SHA256=33AA79CB0C83473C9CA1DE0093AD9F52E0AE71A441910F4B4BDFEE933BA62222,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243157Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:59.278{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat2022-04-20 14:16:57.501 23542300x8000000000000000243156Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:16:59.277{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=1128AA39B65B260122B998DC1DA395D9,SHA256=AB05E8FCE71FD6D73E80E0E7B63CC0E8A18EC0D5F9078AE4CE5F9EDB01981F5B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243162Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:00.738{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243161Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:00.737{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=692059C401D0AE5FBC095DD12B71AF52,SHA256=639C532DA36D0F2B58CD26B16C54CF048FA0A3C315AC9569782D307D860AE863,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243164Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:01.742{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243163Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:01.741{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=658BAAADA2C224795AB78033CC088442,SHA256=05BC927EE0BC271AF455AC592525F263B93C9BA9D926AD20FB8F215A0BAA7522,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243166Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:02.845{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243165Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:02.844{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FB7573413FADAA79BA81B5D7A6385C0,SHA256=1424EBAB413E75940033EF4537AA99BECC83A42F8FAFEE2ABEBA8301BC36EE02,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243170Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.948{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243169Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.948{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74CA130E36E6A4F3CC1D79A4BC2B6359,SHA256=16A3D5129A2888BF7B12BF2CE03A97CCD01E12565C7E1CEA008A04DF11CC89EB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243168Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.301{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000243167Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.301{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243173Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:04.951{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243172Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:04.951{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39112B9F55CFBE352E6926B18561C89A,SHA256=4CABC0EF77F42A923168C098132E764B228F7932AD6E864C1E7EAB98FDC0335B,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243171Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:01.424{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56185-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 354300x8000000000000000243178Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:01.704{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56186-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8089- 10341000x8000000000000000243177Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:05.377{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-1596-6260-0100-000000004402}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+97022|C:\Windows\system32\kerberos.DLL+794d4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2f1f1|C:\Windows\system32\lsasrv.dll+2d0d6|C:\Windows\system32\lsasrv.dll+32919|C:\Windows\system32\lsasrv.dll+30267|C:\Windows\system32\lsasrv.dll+2f1f1|C:\Windows\system32\lsasrv.dll+1752d|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e 10341000x8000000000000000243176Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:05.372{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243175Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:05.281{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243174Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:05.271{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 354300x8000000000000000243192Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.793{8D845A55-1596-6260-0100-000000004402}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56191-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local445microsoft-ds 354300x8000000000000000243191Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.793{8D845A55-1596-6260-0100-000000004402}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56191-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local445microsoft-ds 354300x8000000000000000243190Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.700{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56190-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243189Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.700{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56190-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243188Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.692{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56189-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243187Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.692{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56189-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243186Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.690{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56188-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local49666- 354300x8000000000000000243185Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.690{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56188-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local49666- 354300x8000000000000000243184Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.690{8D845A55-159D-6260-0D00-000000004402}900C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56187-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local135epmap 354300x8000000000000000243183Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:03.690{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56187-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local135epmap 11241100x8000000000000000243182Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:06.303{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000243181Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:06.302{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5810781F83169FA5BF4FC46EEAB7EFF4,SHA256=E6A0FF2E15A877F3373CA47BDCFB7F7FA0D8822CB495E1FE1A2CE4E16F9093DD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243180Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:06.056{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243179Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:06.056{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3E62B4F7439544D9C3C80042D862AFC,SHA256=15450DDAFD012F0D4E21CD61EE89F410DA68B7D9F6F598572AB703EB0138C7C8,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243195Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:07.163{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243194Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:07.163{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DD07C96F00C9AC5E9D5A84A59EAD102,SHA256=1774D1EE6D02832616E513CEEDC87FFB70CEF98B59C3AEA8A019CE73DDA66D25,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243193Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:07.139{8D845A55-159B-6260-0B00-000000004402}636808C:\Windows\system32\lsass.exe{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243197Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:08.168{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243196Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:08.167{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A9D41672A02D62E55A25D39A371CBFF,SHA256=0870D9EB13723B31EFADB44A9F34A7909D5A5A5B448429295CA52BD9F31D1737,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243200Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:06.443{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56192-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243199Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:09.272{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243198Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:09.272{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E889A7459450A94BA724CACB2AF8C07B,SHA256=16C013680D0C122468FA612F19CA499DCB9817B12BC1D179E3BD66C82B17D07C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243202Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:10.379{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243201Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:10.379{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9613FF274F3C089F7BE67C82ED924228,SHA256=C5A2C005BEC3160D9B1ABD7D20A6504BACFBD24D6E2D6D53D9D4FD4CEF3074F9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243204Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:11.386{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243203Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:11.386{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87851BC1BEB8E9FE498788FCB73A09FC,SHA256=58E719671FAD6398D2C8BB59197CB5D3A089AA49998C85229754843168F8D948,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243206Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:12.489{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243205Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:12.489{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE660C4B772C2888AF53ECC3CEEFBBBA,SHA256=F7ECA8D63456C91C1D5EB4A349713866CE63EB0E9FD034FDAF3D6297D701C212,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243208Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:13.594{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243207Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:13.593{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF8C9DBD748C9DDFDACFEF63521B6868,SHA256=E5C6D6E29144973C8CAD8CE28525C954DDECE70CBFB72186EEEDF900A6BEC1FC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243210Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:14.600{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243209Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:14.598{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E140DE07AA0964546BADEA56499EA308,SHA256=D21FFA68245273AC0175069EA876CA4CEFCFEBF765A2A0694866425FACFF8548,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243213Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:15.704{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243212Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:15.704{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=41DFB1C5ACC4454A44662749DDDD3F2C,SHA256=A9814BD7D8F0C226A83870BDA744E3ADB0E755B9B46CC569ED754A9CCD7E45FE,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243211Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:11.483{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56193-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243215Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:16.710{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243214Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:16.710{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=446D4BAA98599BE5EDF6149CD9C42D2E,SHA256=F6990BA4CBE67AC067C914855533FC40F69DA4270FCFE105F329F6D6F36B0D88,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243219Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:17.816{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243218Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:17.816{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=413813773BA3A6EF2E23E031BDB1F14E,SHA256=02C4186675AF6058C88B1B42563BD0B99E551436176CE6F93B6F4487206E9EE2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243217Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:17.129{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000243216Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:17.129{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7F2E51EC0A5348540D93A6D6295C2672,SHA256=61E3224EB4D4BBD0605A97AED734FA1A7127899A27B04EAB145B4D6746340F62,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243221Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:18.922{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243220Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:18.921{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=34F7A01BC058F4E8D665B95761A55C2E,SHA256=F08AE1B8E21DF1CA7D9428F42A08E9297E157C2BAB33D48EB0D4EF64023EECB3,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243224Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:16.664{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56194-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243223Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:20.027{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243222Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:20.026{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=95BF7EB5DE0BF6631E8A579322F60286,SHA256=AB6C28BFC4078C753E32098D79BA86A3FFA771A6D7A8CA306B9A4284A6676C71,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243226Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:21.032{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243225Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:21.032{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F345A041F673E27A30D1AE44CC6220EB,SHA256=B3D63B7EB2A30AB70D3419D0518B42DEC96F79B599CA7C3B901A91A11A77793F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243228Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:22.038{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243227Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:22.037{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A64C53155A9693D9E8B5A715A816FB4A,SHA256=4CDCFE1CE0CB92CAF8838463F765A239B09D1DC4F77EF1B34332FCA88AEA7ABA,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243230Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:23.142{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243229Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:23.142{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9ED53D8D66EBA8B304E73C29BB8A92CE,SHA256=D75BB5CF12F73F1B69F511F8F6D6EF5C0CC608A08933C3407F724D8DF8C38419,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243232Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:24.246{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243231Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:24.245{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=630E9425C6C6E491FEEA513F95C98A86,SHA256=C8FB49FE4EB0161BA20A22637A53A77A3E4372F34B04A5F4774182E7B450BA73,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243235Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:22.507{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56195-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243234Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:25.350{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243233Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:25.350{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=40209A9C02ED0C01C8D7AAE1029567DB,SHA256=8E39933DD28192E4D0C6D0345BA9B1F638D31762F19D36257D63E5A3678967CB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243238Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:26.454{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243237Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:26.454{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=78B427DB37CF6A83062508724AE3AC22,SHA256=E4C418CC20B03AB1EB7FA02A937AD0170033BC2F8B7EC5E2214FD843371F8FA3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243236Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:26.093{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:17:26.093 11241100x8000000000000000243240Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:27.560{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243239Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:27.560{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53928ACF52EBE98C78EEE9C5B557B804,SHA256=9D5DC2E77F0BAF2599CB58AC8B6F3F5CF42CF2F78BB1D280B43890EFCD72B575,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243242Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:28.664{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243241Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:28.663{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BEFC827BA1A25C883BC4015C92B4F294,SHA256=AD0269FB7FFC90551FFCE8B6574ECFEB00B0C256F699982B7FCC2678DF2D889E,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243254Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.690{8D845A55-2409-6260-D402-000000004402}1260C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe 23542300x8000000000000000243253Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.687{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=2D7666CAF536EA5129D8E0EEE8184372,SHA256=5A01812CBB9A84E19A1EC1195C2A43374C6FF54628DB6A9B9DDB041FE1947BC1,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243252Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.669{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243251Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.669{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=76603676127B4C654FA299FF3606E984,SHA256=4091164FD6FB9FA137B1C92208869B4B8E96C2E02D0F33E7E11ABB86328AD97B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243250Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.500{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2409-6260-D402-000000004402}1260C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243249Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.498{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243248Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.498{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243247Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.497{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243246Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.497{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243245Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.497{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-2409-6260-D402-000000004402}1260C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243244Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.497{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2409-6260-D402-000000004402}1260C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243243Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:29.497{8D845A55-2409-6260-D402-000000004402}1260C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000243278Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.839{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-240A-6260-D602-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243277Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.837{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243276Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.837{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243275Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.836{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-240A-6260-D602-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243274Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.836{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243273Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.836{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243272Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.836{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-240A-6260-D602-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243271Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.836{8D845A55-240A-6260-D602-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243270Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.776{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243269Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.776{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9206DF63C77E2E2077A29AA2924F20E,SHA256=1AD0D98513EECDDCFDC9F6038CE0D02C3023F0ECDE445D0F1FF60FF0255B2AF4,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243268Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:27.713{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56197-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243267Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:27.713{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56197-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243266Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:27.559{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56196-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 534500x8000000000000000243265Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.400{8D845A55-240A-6260-D502-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe 11241100x8000000000000000243264Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.355{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000243263Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.355{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A19A29D38D91FBA8CB741F7B2D286257,SHA256=C62114B8F473365FCBBB25DE1C0017BD287DD715EB792C3B120225371AD8E94B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243262Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.167{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-240A-6260-D502-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243261Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.164{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243260Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.164{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243259Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.163{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243258Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.163{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243257Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.163{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-240A-6260-D502-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243256Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.163{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-240A-6260-D502-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243255Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:30.162{8D845A55-240A-6260-D502-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000243290Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.944{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-240B-6260-D702-000000004402}1300C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243289Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.942{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243288Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.942{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243287Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.942{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243286Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.942{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243285Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.942{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-240B-6260-D702-000000004402}1300C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243284Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.942{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-240B-6260-D702-000000004402}1300C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243283Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.942{8D845A55-240B-6260-D702-000000004402}1300C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243282Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.785{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243281Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.784{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5ADA53E19DC7BB0D271AFF2E6A40271,SHA256=F55B05D53B265A62B66813A6F302E459B8AEC4B964D1DF01560EE1D9800A167B,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243280Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.017{8D845A55-240A-6260-D602-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe 10341000x8000000000000000243279Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:31.015{8D845A55-240A-6260-D602-000000004402}48605640C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243304Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.900{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243303Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.899{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=15FA757A697AD2862A96D4F55E0FC37F,SHA256=4628DE20407ECFCABCD671B5B5E8636DE53AFA402DFC0A73A92617707EA0DDD7,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243302Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.777{8D845A55-240C-6260-D802-000000004402}624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 10341000x8000000000000000243301Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.775{8D845A55-240C-6260-D802-000000004402}6245728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243300Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.606{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-240C-6260-D802-000000004402}624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243299Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.604{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243298Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.604{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243297Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.604{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243296Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.604{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243295Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.603{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-240C-6260-D802-000000004402}624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243294Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.603{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-240C-6260-D802-000000004402}624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243293Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.603{8D845A55-240C-6260-D802-000000004402}624C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000243292Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.114{8D845A55-240B-6260-D702-000000004402}1300C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 10341000x8000000000000000243291Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.113{8D845A55-240B-6260-D702-000000004402}13004080C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243322Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.959{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-240D-6260-DA02-000000004402}2524C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243321Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.958{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243320Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.958{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243319Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.957{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243318Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.957{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243317Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.957{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-240D-6260-DA02-000000004402}2524C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243316Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.957{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-240D-6260-DA02-000000004402}2524C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243315Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.957{8D845A55-240D-6260-DA02-000000004402}2524C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000243314Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.443{8D845A55-240D-6260-D902-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe 10341000x8000000000000000243313Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.442{8D845A55-240D-6260-D902-000000004402}46645144C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+610325|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60fe56|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60943|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+9e7f20|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243312Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.277{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-240D-6260-D902-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243311Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.275{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243310Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.275{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243309Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.275{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243308Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.275{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243307Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.275{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-240D-6260-D902-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243306Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.275{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-240D-6260-D902-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243305Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:33.275{8D845A55-240D-6260-D902-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000243325Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:34.149{8D845A55-240D-6260-DA02-000000004402}2524C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe 11241100x8000000000000000243324Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:34.009{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243323Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:34.008{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7CA9884551EF24B85C6FD33D81471F2,SHA256=F8195C401B28751DBFF32054FBA4E7C189B6677D0C37E0FBCC33140CB70A8623,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243328Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:32.644{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56198-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243327Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:35.017{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243326Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:35.016{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00D583DCBC5BE336D47BD3CEE1765C16,SHA256=15D71307DA287A44A3BFE4DC5529D64600A700B1EE7EFB8FACDE27FDCE53E951,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243330Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:36.120{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243329Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:36.120{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=253E155DD2D3A9454868047064A6942F,SHA256=FB6CD3585C0A2D82FD1003B8267D4ABC282C105BEB97277269A8E6F603FF3CA1,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243332Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:37.223{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243331Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:37.223{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83F577BDF24EC4031C202E63F5AE90FF,SHA256=509BBAD30772DAD62F93B75A760E26A5B9697D0E60401B414F526BD9B5ABB974,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243334Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:38.328{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243333Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:38.328{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C4E3B74AB23E0DE3BC03D5281BD0E83,SHA256=7928840831DDBF7E21A1B846B69958ED48DC94C5A7DC6A231A9A6766060CA343,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243336Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:39.434{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243335Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:39.434{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CF1EF5549492F115E80492B016924C4,SHA256=1ACE8B03A9AA58E933E6D0C57EE164DF87F0AAC47DF18A9600A816CDB436ADAE,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243345Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:36.454{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domainfalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local57538- 354300x8000000000000000243344Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:36.453{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53480-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domain 354300x8000000000000000243343Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:36.453{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53domainfalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local53480- 354300x8000000000000000243342Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:36.453{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetruea00:10e:0:0:9890:5ff5:cd7:ffff-53480-truea00:10e:4424:584d:85c0:740f:488b:d45-53domain 354300x8000000000000000243341Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:36.452{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local61092- 354300x8000000000000000243340Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:36.451{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56615- 354300x8000000000000000243339Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:36.451{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56615-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domain 11241100x8000000000000000243338Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:40.437{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243337Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:40.436{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A2330B523E65B92A85CECD0CE0294AB,SHA256=AAAC6075CCAE5A0084193D23A7DB084A1CC9CC449EF32EF2B8CF71428F307605,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243347Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:41.443{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243346Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:41.442{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=809F05E5049F65832804D09FDB2B9179,SHA256=7A8535C0A079524619700E75E91858582999D3A5C74E9C9120AB6F4A6299D475,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243350Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:38.438{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56199-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243349Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:42.546{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243348Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:42.545{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB85E7DB48C56D63FB5DC5D519F67793,SHA256=3305743EEF94C8B8F39AD3724D99D74EF37F90990CAAC2773570E76298094740,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243352Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:43.650{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243351Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:43.650{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7E2FB5D6B6B8BF81A0029DB6146AE099,SHA256=5B399D01307A0A67351FED7A95ACFB06F94FFA59CD74BE49F0E3BCA20C5ABDC2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243354Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:44.754{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243353Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:44.753{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A32EECC3DEBF70FE26DA3ED90F206A87,SHA256=72DF2958120564B55ADA5843C7BAEF559D569B36721F91D54636B5904C855FCB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243356Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:45.856{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243355Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:45.856{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=790E2345C8F1567A1F2712ABB80CFCA7,SHA256=C9A201E7097AA1CCE8B63778E11DF03FBB15D0CF9C0117E794708EF2BA9C4FE7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243359Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:46.864{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243358Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:46.863{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA79CF7ABDA2C91190D3479C3852509A,SHA256=F5C82D07C17EBEFC8238A0AC299A2B3E9D99FA21F498F61ED623C76DFB3E4EAC,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243357Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:43.618{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56200-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243364Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:47.967{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243363Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:47.966{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5910211C809113F6E0BD47ECDE322C0,SHA256=B329273C188932A29FA4F881B26EE0B48D5919469D1FBAA4860E04783136858A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243362Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:47.449{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\respondent-20220420141616-059MD5=8D93873C901538A8B2B909297EDAE7BB,SHA256=9423023AAA5D37B26F7EE3576993D2852CE2F95EF8E5E497C042A8474DDD26FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243361Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:47.446{8D845A55-15B0-6260-4700-000000004402}3580C:\Program Files\Amazon\SSM\ssm-agent-worker.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\respondent-20220420141616-0592022-04-20 15:17:47.446 11241100x8000000000000000243360Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:47.445{8D845A55-15AE-6260-2D00-000000004402}2972C:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\surveyor-20220420141614-0602022-04-20 15:17:47.445 23542300x8000000000000000243365Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:48.447{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\surveyor-20220420141614-060MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243367Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:49.069{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243366Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:49.069{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=017182EDE1D12D675A8E4D6A8E522139,SHA256=09750379D8205BF0C95C9C1FED75BDB319979DD9243038292368C2C9F34AC316,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243369Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:50.173{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243368Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:50.173{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3FD863430F4481016354EFF1A47A2534,SHA256=8EFB40A02761C3FEEF9DC96BA4F0967C407E98C97FFF4284370FE69C18470BCF,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243372Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:48.648{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56201-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243371Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:51.277{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243370Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:51.277{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CCDF705E4C6F98E2270659924021499,SHA256=04707859E8F5BFAD55D28DCD8A6CE24CE23F058C823B77B05EB6011E54B6C04E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243374Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:52.381{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243373Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:52.381{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=342A96C714863A1B4A4FE8575EDBEBA3,SHA256=D55AEBDD089A93613AD8B74C29B24698025BC0BE08D946577320B58FA6AAD24D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243376Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:53.389{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243375Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:53.388{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6AC800B74BC2B8812BF5E08DA276F271,SHA256=4D928B4BD8723733424F9A64B352638F56C86FF4D19D079356E15583FCAC183A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243378Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:54.492{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243377Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:54.492{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=70D9B74A61C15997E59C6E932A530B48,SHA256=C643113823BC0FAE6D3A01DC63C383508495A1AB1DF234E8972431DE7998AF2A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243380Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:55.497{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243379Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:55.497{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8DC268941DBBB59AB7F34C75B8368E7E,SHA256=B8A5924F7D55026889352E24EC682F3F81314A5F111E2E148CE06971A4C3797F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243383Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:56.604{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243382Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:56.604{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDBB09601D7CF280BE8FD76C6D3880B7,SHA256=3BCCB03758B17F95F9D5C3F01716B0C6B56CB3AA4BAA9D793D94FDFF8E5D5D66,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243381Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:56.093{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:17:56.093 11241100x8000000000000000243385Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:57.609{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243384Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:57.609{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=23E644E983C5448910A17BA725FCB711,SHA256=13622D25048D2AD87CC07F0B64E3A600C40E7FFA7DB96F3DB758EBDC703536ED,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243388Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:54.457{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56202-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243387Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:58.713{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243386Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:58.713{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A663DFDD5E17FE86B2D29FD0DC2D08FB,SHA256=D1A65F4BA8A852F429FF4B295BB8A189895ACCC324491F6AE5AB896EDF42848C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243393Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:59.912{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=BAC425A781384B55CFDBA0C7E3F8578C,SHA256=B9259DB1FDF63FD00CD53CDD62F6A7C95A4EBC1AFC26D029D105DA0A2B9C4AAF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243392Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:59.719{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243391Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:59.718{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B1A6C767D3C9D8C11F1E16D81BABF26,SHA256=756396C977DF39F6B99246D3C8BD479952DF9ABD97E510F5CC28183508DD445F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243390Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:59.276{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat2022-04-20 14:15:57.498 23542300x8000000000000000243389Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:59.276{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=DC7198A3C42A414B37537C4AE5586B7F,SHA256=12630239C273BEAC0AF008F13673FB71751DC7887E7453A53E046C5282EC8594,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243395Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:00.724{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243394Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:00.724{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=93714E127C4878C7236A941C8EB134FD,SHA256=FD19D970C22B191A2742092F53AF7F88753A76649BDE7C71ECA0D6118F97D603,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243397Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:01.740{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243396Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:01.739{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D07C627A39C27BF7DF0E42E0DF4793B1,SHA256=A66371BD139D2E720908F629A9D263419C7088ED47C7A7FE0B244CA825564C8C,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243400Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:17:59.591{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56203-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243399Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:02.748{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243398Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:02.748{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=389105FBD3762E8B268A8ACA563B6E0A,SHA256=444CD7F1014BD301BA6E546CDBE3941C8ED4832E2E84643081FBF0FCB45B04C6,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243404Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:03.856{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243403Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:03.855{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51775A041E45EBBD298C313AE54DBFF5,SHA256=30C231785DC6E59CF87CECF0FCADE383429694DBEB9FAE91FCF9121067096BA0,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243402Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:03.314{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000243401Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:03.313{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243406Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:04.859{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243405Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:04.858{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07D7917795AA09FA2E97743A299C3D4C,SHA256=E61868A7C05225ED32F09375B24B5EC952F14362F5A06EE374F74114EE62B2E1,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243409Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:05.965{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243408Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:05.965{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63F986E0CF8D5C01B4D19B36341F57C4,SHA256=09788C4F4D0CCFB774A05766F9B293573C1EBDFF6FF941BB00E4BE93CB3BBC0F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243407Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:01.720{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56204-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8089- 10341000x8000000000000000243410Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:06.265{8D845A55-159D-6260-0D00-000000004402}9005648C:\Windows\system32\svchost.exe{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3d877|c:\windows\system32\rpcss.dll+29a97|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243412Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:07.072{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243411Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:07.072{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=255F98E2672181F3304A9B996C30BE32,SHA256=17EEAE0E35718B4D6DF0ED0CD4482E1D055F48D74C1A8EF0037048FAF28B1545,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243415Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:05.525{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56205-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243414Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:08.081{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243413Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:08.080{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4F748D13B8AB4B0E71C86B57AEECE62,SHA256=5DDB05AE1A489518537DB67F8872F673BF128768AA4886BFFAE3E964ADA2BEC3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243417Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:09.184{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243416Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:09.183{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39772AA1745D0A9C0851125C1AC8061D,SHA256=AC9D23ADCA881B77CBC7E0E3ED5693C7AE31572ED0F3438D805C634BCF42494B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243419Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:10.289{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243418Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:10.289{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C229618FED76CDDECA48E7F65D1E974F,SHA256=19B683B19DA56C52C1B7E3A73FBA73B674E56937D543B19D448BFD279FC69958,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243421Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:11.393{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243420Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:11.392{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BEC726CE6832539C1B27D33959D78D00,SHA256=7A4473B583BEA7DFDB241BF5F1E21880CB4AA1F793E9A9D387B3307A3DFDEC73,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243423Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:12.497{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243422Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:12.496{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B02230A4513088EDC326EC412DBA5F9A,SHA256=9C88259151E7D2C481909034C740203AF1F9B789C1CF250431D00606276E6BB7,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243426Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:10.644{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56206-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243425Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:13.599{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243424Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:13.599{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EECD13923A103B849BF6D65944F6BF60,SHA256=FC306E5DEBF72168212551325576C67D9FEF4AA85D1B93A4BA9039EA9EDDED3D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243428Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:14.702{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243427Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:14.702{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5EE0555649CFB2579D6A54A40F73A82A,SHA256=6C92EF87BF22DCD7EA8B064E07DFA646710746EDBD1759863D124DEBE111564C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243430Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:15.806{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243429Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:15.806{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74B4E6ABFFAD00990850C99DC308EC65,SHA256=23B259AAF5A2A001C12C0979BDEF4E7977D5012946B93A1E36DC94DC11999B89,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243439Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.974{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243438Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.974{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243437Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.974{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243436Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.971{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243435Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.971{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243434Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.971{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243433Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.970{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243432Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.812{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243431Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.812{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33F46E5BDA9C6E2D077FF615CB4F5850,SHA256=259DDB584B35DFA2D117A382281904B8A89BA7115AF1473792FA17E3B61FFF13,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243441Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:17.922{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243440Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:17.922{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5EB715501E92482BA86ACB96EC1E8D5F,SHA256=5BFE227FF07A069CF94BF74D5E5B32455E204B70B9B999D3DE4B19E673DE703F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243454Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:16.425{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56207-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 10341000x8000000000000000243453Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.456{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-159D-6260-1500-000000004402}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243452Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.455{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-159D-6260-1500-000000004402}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243451Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.455{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-159D-6260-1500-000000004402}1248C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243450Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.028{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243449Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.028{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96A97D5B44B29F40C9BC5B6F12CC4568,SHA256=1B462F93B91E0D9560E234F958A5F0F329336261ACF7EC043738B15E5EE3D02B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243448Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.026{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243447Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.026{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243446Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.026{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243445Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.021{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243444Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.021{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243443Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.021{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243442Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:19.020{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243456Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:20.141{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243455Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:20.141{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B565E76B9A0A75ACA93C9E20F2CF71B3,SHA256=0B57DF09841042C9D63DC20282099B09E863B73BED69C0C3EF2E21A7D1931925,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243458Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:21.246{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243457Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:21.246{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21D7B71EC5AFF01BEB0462F8B22DB60E,SHA256=C0E11243654008894F8FFE782D0AB9E22B1026200D894E79C5BD640CD779310C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243460Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:22.349{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243459Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:22.349{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D207204D0CA66ADF6202660A0ED5ACB7,SHA256=33FE42D5B57F0256B7AFC1D9AA307AD53DDC47F6B8ED171A9D6AE20D4992B37B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243462Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:23.455{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243461Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:23.455{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F5E6D9434FC2930204FC17FD599C4CE,SHA256=D763A6A30FA025ABB47F93A41326F078D5C81A1CCAD12EC6503690A022A002F8,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243465Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:21.579{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56208-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243464Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:24.558{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243463Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:24.557{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2DD0F06E3F000D213E577C5C94B52FD1,SHA256=7D70378743740437F0BE4366E5131CF51B5285BDBBCA60034E64CECC46F84A01,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243467Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:25.561{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243466Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:25.561{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9E4DA48BB63DD73FF4DC9B0807AD46E,SHA256=A3C4CFC0BC324A504599AD2BBCFF39B9BB6440BC076D863C68522E757CD1C94F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243470Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:26.573{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243469Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:26.571{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C4FCECB3346CF43ED34D405BE89084B,SHA256=F6E68567FBC45870A3C96CBF8BC8835C6D238AD8E1900AE76906D99A7F0E41F4,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243468Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:26.094{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:18:26.094 11241100x8000000000000000243472Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:27.675{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243471Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:27.675{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AFEFC1271B90E49110D0836235F5CE1C,SHA256=C21C2535904A27758F0809A17A5C49E90234C74C18737849EC758154DC458910,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243474Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:28.781{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243473Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:28.781{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BF2D54069FF18F8BA2E56163DC87C44,SHA256=690358DAAA44CC4C0597F755FCBB59B331CAA379F7E5B3FF675358F31B5DCB05,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243487Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:26.609{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56209-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243486Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.790{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243485Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.789{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFDB51D0023D8D0C50105C62BA5A7777,SHA256=0CFEA5092E8D94C0476252005222AF7CEFFE08A53339196F7D82F4845BFC6DA3,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243484Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.691{8D845A55-2445-6260-DB02-000000004402}4772C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe 10341000x8000000000000000243483Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.495{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2445-6260-DB02-000000004402}4772C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243482Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.494{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243481Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.494{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243480Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.493{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243479Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.493{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243478Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.493{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2445-6260-DB02-000000004402}4772C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243477Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.493{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2445-6260-DB02-000000004402}4772C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243476Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.493{8D845A55-2445-6260-DB02-000000004402}4772C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000243475Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:29.116{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=933AB2C7139F0356911442E321300ECF,SHA256=D07A393D43D7F0D1330D3CE8A96B27FE1AFF1BA3148C7A6EF296BB1068CF0160,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243512Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.995{8D845A55-2446-6260-DD02-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe 10341000x8000000000000000243511Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.992{8D845A55-2446-6260-DD02-000000004402}33764204C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243510Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.828{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2446-6260-DD02-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243509Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.823{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243508Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.823{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243507Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.823{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243506Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.823{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243505Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.822{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-2446-6260-DD02-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243504Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.822{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2446-6260-DD02-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243503Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.822{8D845A55-2446-6260-DD02-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243502Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.801{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243501Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.800{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0935A4EA7C31707AF31C10EAA831FC06,SHA256=925319AD5881F97CB9853969EAEF9938D0CC8A1FCB120C9D06A89E08B313392D,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243500Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:27.713{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56210-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243499Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:27.713{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56210-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 534500x8000000000000000243498Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.399{8D845A55-2446-6260-DC02-000000004402}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe 11241100x8000000000000000243497Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.340{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000243496Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.340{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7697619E47780F6871765B76CC887259,SHA256=E314ECA39309B306C00FAF333A3E0E3DF3D40B61DE8516C84C8A3FC0F48B1796,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243495Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.164{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2446-6260-DC02-000000004402}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243494Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.162{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243493Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.162{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243492Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.161{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243491Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.161{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243490Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.161{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2446-6260-DC02-000000004402}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243489Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.161{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2446-6260-DC02-000000004402}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243488Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:30.161{8D845A55-2446-6260-DC02-000000004402}1016C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000243524Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.998{8D845A55-2447-6260-DE02-000000004402}2036C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 10341000x8000000000000000243523Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.996{8D845A55-2447-6260-DE02-000000004402}20362596C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243522Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.836{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2447-6260-DE02-000000004402}2036C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243521Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.834{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243520Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.833{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243519Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.833{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243518Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.833{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243517Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.833{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-2447-6260-DE02-000000004402}2036C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243516Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.833{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2447-6260-DE02-000000004402}2036C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243515Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.833{8D845A55-2447-6260-DE02-000000004402}2036C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243514Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.807{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243513Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.807{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C18B3280B5A80C3D677967DFFC1F9C78,SHA256=5B8B40A091F2E82B59F5F98B3D2128B9A990B6B2A7EB9CDB9DBE9F78C2D50154,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243536Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.917{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243535Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.916{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D9164C1E5E199282FE53A5C2CB7A63E,SHA256=7AFEC663DF1ECFD12905F2EA1C1827BF53238EDE15B5E37F3FAA990456CF0782,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243534Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.710{8D845A55-2448-6260-DF02-000000004402}5116C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 10341000x8000000000000000243533Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.708{8D845A55-2448-6260-DF02-000000004402}51165816C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243532Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.498{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2448-6260-DF02-000000004402}5116C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243531Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.496{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243530Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.496{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243529Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.496{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243528Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.496{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243527Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.496{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-2448-6260-DF02-000000004402}5116C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243526Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.496{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2448-6260-DF02-000000004402}5116C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243525Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.496{8D845A55-2448-6260-DF02-000000004402}5116C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000243564Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.828{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2449-6260-E102-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243563Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.826{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243562Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.826{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243561Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.826{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243560Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.825{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243559Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.825{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-2449-6260-E102-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243558Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.825{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2449-6260-E102-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243557Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.825{8D845A55-2449-6260-E102-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000243556Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.629{8D845A55-15DF-6260-9400-000000004402}43242492C:\Windows\Explorer.EXE{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+6497|C:\Windows\System32\SHCORE.dll+6387|C:\Windows\System32\SHCORE.dll+62fd|C:\Windows\System32\SHCORE.dll+620a|C:\Windows\System32\SHELL32.dll+af4a0|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9824|UNKNOWN(FFFFF800B9E62B58)|UNKNOWN(FFFFFDB12ECA5B88)|UNKNOWN(FFFFFDB12ECA5D07)|UNKNOWN(FFFFFDB12ECA0391)|UNKNOWN(FFFFFDB12ECA1D5A)|UNKNOWN(FFFFFDB12ECA0016)|UNKNOWN(FFFFF800B9B78503)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+b2cfb|C:\Windows\System32\SHELL32.dll+5360a|C:\Windows\System32\SHCORE.dll+33fad 10341000x8000000000000000243555Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.629{8D845A55-15DF-6260-9400-000000004402}43242492C:\Windows\Explorer.EXE{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+1c0e5|C:\Windows\System32\SHELL32.dll+aef81|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9824|UNKNOWN(FFFFF800B9E62B58)|UNKNOWN(FFFFFDB12ECA5B88)|UNKNOWN(FFFFFDB12ECA5D07)|UNKNOWN(FFFFFDB12ECA0391)|UNKNOWN(FFFFFDB12ECA1D5A)|UNKNOWN(FFFFFDB12ECA0016)|UNKNOWN(FFFFF800B9B78503)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+b2cfb|C:\Windows\System32\SHELL32.dll+5360a|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 23542300x8000000000000000243554Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.629{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF396a4d.TMPMD5=DD8C29AAE0A45C3822ADE0E7CA84C037,SHA256=448C743772008F1A6623E6915E6111011845DFE3385A89996681D81E97DA526D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243553Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.627{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF396a4d.TMP2022-04-20 15:18:33.627 11241100x8000000000000000243552Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.622{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LLMBLDZ44G5ESJQF6EOR.temp2022-04-20 15:18:33.621 11241100x8000000000000000243551Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.351{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\1huziwj5.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F2022-04-12 13:31:22.974 534500x8000000000000000243550Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.351{8D845A55-2449-6260-E002-000000004402}5904C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe 10341000x8000000000000000243549Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.349{8D845A55-2449-6260-E002-000000004402}59044080C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+610325|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60fe56|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60943|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+9e7f20|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243548Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.246{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm2022-04-20 15:18:33.246 11241100x8000000000000000243547Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.246{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal2022-04-20 15:18:33.245 11241100x8000000000000000243546Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.239{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm2022-04-20 15:18:33.239 11241100x8000000000000000243545Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.239{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal2022-04-20 15:18:33.239 10341000x8000000000000000243544Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.162{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2449-6260-E002-000000004402}5904C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243543Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.161{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243542Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.160{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243541Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.160{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243540Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.160{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243539Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.160{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-2449-6260-E002-000000004402}5904C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243538Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.160{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2449-6260-E002-000000004402}5904C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243537Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.159{8D845A55-2449-6260-E002-000000004402}5904C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000243577Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:34.546{8D845A55-1E68-6260-1002-000000004402}5452ATTACKRANGE\AdministratorC:\Program Files\Notepad++\notepad++.exeC:\Users\Administrator\AppData\Roaming\Notepad++\backup\AttackRangeSysmon.xml@2022-04-20_151834MD5=3DB1E293ACA5E7A7559FC292E1F2B25F,SHA256=57DB6ED7481AE48F63BF2AA10CDA81A6C7CDA7782334071B04A9893A9EB2E1BD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243576Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:34.537{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exeC:\Program Files\ansible\AttackRangeSysmon.xml2022-04-12 13:18:48.382 23542300x8000000000000000243575Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:34.536{8D845A55-1E68-6260-1002-000000004402}5452ATTACKRANGE\AdministratorC:\Program Files\Notepad++\notepad++.exeC:\Program Files\ansible\AttackRangeSysmon.xmlMD5=7DB5B68C526D2B4002F6BB72B7C5F7F8,SHA256=FA39A46562A507323D8AD7F29A48D452FC707DCCF4DE3693C28040735B8F6B28,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243574Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:34.391{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243573Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:34.391{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E8E85BD5E1ECAB66B226C418D6496BC,SHA256=77E718CBCBB201056A8000E33CB51378533B5FD76607B9570B999BA51A62ED58,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243572Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.659{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53846- 354300x8000000000000000243571Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.657{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local63261-false10.0.0.2ip-10-0-0-2.us-east-2.compute.internal53domain 354300x8000000000000000243570Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.657{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local54167- 354300x8000000000000000243569Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.657{8D845A55-159D-6260-1400-000000004402}1040C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local54167-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domain 11241100x8000000000000000243568Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:34.268{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exeC:\Users\Administrator\AppData\Roaming\Notepad++\session.xml2022-04-14 17:01:56.838 23542300x8000000000000000243567Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:34.267{8D845A55-1E68-6260-1002-000000004402}5452ATTACKRANGE\AdministratorC:\Program Files\Notepad++\notepad++.exeC:\Users\Administrator\AppData\Roaming\Notepad++\session.xmlMD5=EB5A06062A409BFA6044822406FD6681,SHA256=334550DDAE5E36195F03D6A5370819B4B251D0A2573B310F6953E001D12C15CB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243566Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:34.260{8D845A55-1E68-6260-1002-000000004402}5452C:\Program Files\Notepad++\notepad++.exeC:\Users\Administrator\AppData\Roaming\Notepad++\backup\AttackRangeSysmon.xml@2022-04-20_1518342022-04-20 15:18:34.258 534500x8000000000000000243565Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:34.008{8D845A55-2449-6260-E102-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe 354300x8000000000000000243581Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:32.486{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56212-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 354300x8000000000000000243580Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:31.670{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56211-false34.117.237.239239.237.117.34.bc.googleusercontent.com443https 11241100x8000000000000000243579Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:35.341{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243578Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:35.339{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F5C49C391D9820C04EF34650ED743FE0,SHA256=C155AF35755B93AC647BBF2D4F0B4B8B3180B1331DA53C9C6E3A460947681727,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243586Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.810{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53796- 354300x8000000000000000243585Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.809{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local52799- 354300x8000000000000000243584Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:33.784{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local59486- 11241100x8000000000000000243583Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:36.344{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243582Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:36.344{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B7614BDFC5BFE3E75B9E3A60BC66F49,SHA256=3416BAAF576CC8A7B2F39DF40C9382F0F5EFA0188FBE5CD43F8A4569104BE9A9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243591Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:37.450{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243590Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:37.450{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E6F9E1AA8C6B944E80440EC865073A2,SHA256=904D216C2026AA28ACEF7642BF06CD67C13E9680542555D8884C2D416848AB39,IMPHASH=00000000000000000000000000000000falsetrue 22542200x8000000000000000243589Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:35.409{8D845A55-1AE7-6260-9101-000000004402}6032e10109.dscx.akamaiedge.net02600:1408:c400:1888::277d;2600:1408:c400:188d::277d;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x8000000000000000243588Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:35.396{8D845A55-1AE7-6260-9101-000000004402}6032e10109.dscx.akamaiedge.net0104.104.94.85;C:\Program Files\Mozilla Firefox\firefox.exe 22542200x8000000000000000243587Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:35.395{8D845A55-1AE7-6260-9101-000000004402}6032www.hotels.com0type: 5 ipv6-global.hotels.com.edgekey.net;type: 5 e10109.dscx.akamaiedge.net;::ffff:104.104.94.85;C:\Program Files\Mozilla Firefox\firefox.exe 11241100x8000000000000000243594Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:38.462{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243593Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:38.461{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=006E62FD63D5D1F73E662A856C2C9941,SHA256=D6C1660BB799C7E6F8A8810611A56B5A86FC2367CA3094A61D006A7A8BF9FB4F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243592Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:38.237{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\1huziwj5.default-release\cache2\doomed\28782MD5=B35213774A7C4662827D06AD6266CD72,SHA256=32756A64BA5E926E10E452B30A3304CA2DE6BF39B7A808D33BC424B96A107FDC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243596Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:39.569{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243595Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:39.568{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D9D00BB92F79EFB784A1DFCA70285DD4,SHA256=196386071B56744033B0921E2AB73741F93B06F0A2EA1186A5C09299B52F653C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243598Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:40.574{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243597Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:40.574{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3508386413EA56E18B77510BCB255DC6,SHA256=2586E0DF033B1418B17A9CF7B465BD29D6396D51C605B1543C5D4B38094FEA2C,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243603Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:37.524{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56213-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243602Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:41.583{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243601Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:41.583{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DE237FC25506B967B0691AEEC68D1BB1,SHA256=BBA4CC7040F66C08F922CE7CB5D0D903DFC15B2C97ED0D00E4B5E2F95E4E4E50,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243600Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:41.287{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000243599Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:41.286{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=402711973CBFF44FEBBBE836D1D4B805,SHA256=C6775DD35F1761A4C64F79F147A0541CB415707A1B19D1702181FF06D49E984D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243605Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:42.589{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243604Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:42.589{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=984FD51464849E92095177E53F2014C4,SHA256=6D2C57D0E6315D383CC2C811BE4779A74D712D73EB963AEC01D9E15290F55EC0,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243607Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:43.694{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243606Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:43.694{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07A87458007B2E05D307CE0E9E7F9E45,SHA256=86F2871013F30292694406ECF3F6C869EFD72295532B3BEBC4FDD4E5FEF54E00,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243609Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:44.802{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243608Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:44.801{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=28E2633FD370524A55A9E63B86654844,SHA256=FAF8282D76259904C7E29DF35DE6012C9275E69FDE945EA2B706194DD8A31B9B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243614Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:45.905{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243613Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:45.905{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B517E3963D51B183D9F6F4F23B94536D,SHA256=2251A335F49452423618A9187DE56B569DD3114FA708C9C3CE8F70DF971BDB44,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243612Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:42.560{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56214-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 23542300x8000000000000000243611Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:45.361{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmMD5=B7C14EC6110FA820CA6B65F5AEC85911,SHA256=FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243610Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:45.359{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmMD5=E0C8333E14042EE39094E21E5B349707,SHA256=9CF2541D2E1F173EBF4AF5901282FF547F9A2B5B2C5BA5D228CBBCA691658596,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243616Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:46.910{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243615Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:46.910{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A57FCE1919FFCD68B636507A7D8905F,SHA256=76E2537D707071017DD11C45453BDCC61D869C53B09B4F27379E090D5108E34D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243621Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:48.950{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\respondent-20220420141616-060MD5=8D93873C901538A8B2B909297EDAE7BB,SHA256=9423023AAA5D37B26F7EE3576993D2852CE2F95EF8E5E497C042A8474DDD26FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243620Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:48.949{8D845A55-15B0-6260-4700-000000004402}3580C:\Program Files\Amazon\SSM\ssm-agent-worker.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\respondent-20220420141616-0602022-04-20 15:18:48.948 11241100x8000000000000000243619Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:48.947{8D845A55-15AE-6260-2D00-000000004402}2972C:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\surveyor-20220420141614-0612022-04-20 15:18:48.947 11241100x8000000000000000243618Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:48.014{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243617Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:48.014{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BDABDE182B7FB6C088227A632065090D,SHA256=41884F672FB429E22DB1E06677E1BDB3AC8E564335C3E693E71EDF1F8425D573,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243624Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:49.948{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\surveyor-20220420141614-061MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243623Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:49.019{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243622Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:49.018{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C105D419D1404852963DBC66BACAC3F9,SHA256=9EA53F52352D12974F94BA53670100861EAA059C7A7DF77AE90A8EE6B981D39D,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243627Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:47.584{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56215-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243626Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:50.023{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243625Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:50.023{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2BCABB3572803012D7C09E0129ABC06C,SHA256=932001443DC21FF3FA65605E26A49D605D59190C5A7CEEB7F041C0F1D660A1B3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243629Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:51.127{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243628Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:51.127{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FC2DB20D50441432E1FEF9CD0CD75FEC,SHA256=5D8D0FF947AB726AD7BDFF2D629AB105617D04E20D79EAB4E31AF3A7E913C229,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243631Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:52.232{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243630Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:52.232{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4EECFBC38EF2B88E00213BBA8AFD6922,SHA256=6DE387A2DBFEBD73679DCF242D9A49D9EF38B8B07A29C5DCC735C397D5AE6DCF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243633Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:53.237{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243632Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:53.237{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7378E48FCBB3451E360B61E76CB8726D,SHA256=CC7C25864E5C3ED29B1511CA4028508EC1D3466C4EF68E17CB5081D31D14F6D4,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243635Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:54.340{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243634Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:54.339{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1BE70F0062DBA68B35419DCDACC438E,SHA256=1AF7D6BD4BCC0A44FB780ACAFAC34D5886550B16F6ABEB95E3F258ABFBA60358,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243637Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:55.444{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243636Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:55.444{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C74BE6263AD4D4707EAED6B227AD369C,SHA256=C036DFD48206BAE990840E93D20E90E1CF9A6D68BB6A6E713E77BDAD88B6B3D6,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243641Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:53.451{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56216-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243640Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:56.464{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243639Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:56.463{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D92B3C15FBA8928BDB4238DCFD3DBE5,SHA256=83BE9C26B6A0C0CB714F0A5F6A7F840FFC7D8DEEA2D97B7A54967D4BD04C2692,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243638Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:56.097{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:18:56.097 11241100x8000000000000000243643Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:57.470{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243642Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:57.469{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C934F3953DA431712A947E39855D8CA0,SHA256=14B777486A5D396FAC9A925DEDA60C840952889B45D89A9651F5FD1BC3A7AAF7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243645Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:58.574{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243644Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:58.574{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F165B543B0CA62C8620FEF124C944A1,SHA256=A69F6B3C0A48B88B22E0D3FFAFBF11B9F20B2CF096BE5C3D9FC565F4F4992620,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243650Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:59.679{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243649Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:59.679{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C05DF12FA07E15CB6A0C6A914374574C,SHA256=2DD043487F1889CF03AD3563E738712D78039BB36C9A695FF32D7D1DC45CB32D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243648Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:59.348{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=1C6E27C673219548BD4FFDB73470BD5D,SHA256=FA478EC2F685A67A5859113A8A8F70709EF91AB206E38B007EC5CCFE9E60B3F3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243647Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:59.274{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat2022-04-20 14:16:57.501 23542300x8000000000000000243646Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:59.273{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=20F6783B0F04B349FAA02988E5ADE97E,SHA256=450342CEA7A625D7F8F8E67EF7E9B8E25877C24AE98CBB57944187A2535E8530,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243662Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:00.785{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243661Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:00.785{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5841FC76541898E8C03B9A908F7AA619,SHA256=0E298E720C8F5154EF94BDB114F93D8E2BC46190952E6C8250153EC7590ADE98,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000243660Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x8000000000000000243659Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0039d1e1) 13241300x8000000000000000243658Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d854c1-0x9424b9ea) 13241300x8000000000000000243657Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d854c9-0xf5e921ea) 13241300x8000000000000000243656Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d854d2-0x57ad89ea) 13241300x8000000000000000243655Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x8000000000000000243654Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0039d1e1) 13241300x8000000000000000243653Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d854c1-0x9424b9ea) 13241300x8000000000000000243652Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d854c9-0xf5e921ea) 13241300x8000000000000000243651Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:00.136{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d854d2-0x57ad89ea) 11241100x8000000000000000243664Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:01.890{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243663Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:01.889{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8D785088AC52F9AC60F4F7C385A1B8B,SHA256=4599C77656E8C7C313C2369460869C2D4C17EB2B45D6B5857706BEB5210FBF9E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243667Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:02.995{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243666Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:02.995{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3CC2278F0FFD4D153AE5304AB741BDE0,SHA256=CCD846A8E7E8A33A00B1F67AE2126BC440CB237751987F94815AA265F48F5E3A,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243665Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:18:59.433{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56217-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243669Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:03.337{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000243668Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:03.336{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243672Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:01.737{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56218-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8089- 11241100x8000000000000000243671Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:04.100{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243670Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:04.100{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0E94A5B1C75E3FDFA4929ED720FF9A35,SHA256=8768436537951481266FFFEE73E33C669FBC9AF8F1D518BCA6695A7F59EECE9E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243674Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:05.207{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243673Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:05.206{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A20C02863497A37172B13C0DC0670F6,SHA256=F533D89BFE94CBAB07E92518A9BA162886394111B56830E27F1D8BEB9A5BF9BF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243676Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:06.313{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243675Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:06.313{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0531296C5BDE261F7F14F85C32D447D2,SHA256=6FBF59B24875FE606D60E513F3420EC68668E498DB3181D08562E7D71FFBBBAA,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243679Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:04.560{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56219-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243678Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:07.415{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243677Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:07.414{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=740AAE5A69FC99C4094CE35DCE765E48,SHA256=50CBC9D870497E52043C0309E7F29176727B98E0FE04289CA50FC563F715406E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243681Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:08.519{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243680Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:08.519{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39DDCC30B5874A96E91B560F43DC2EDC,SHA256=6F09D51EB69456C0B547E37EFD803C3387449CF3793C36393875D9C0E6310129,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243683Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:09.625{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243682Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:09.624{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=750FC6B9AF87ED11FF4023B8BB01637D,SHA256=CD759E659746160D3CF93C969801CDD8A7C5969D4791BFFD4D3F412782CB7DBD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243685Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:10.737{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243684Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:10.737{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE632C4D95CFAF5C3D51C98A4E05D552,SHA256=F6C2F156AD96525C4694D67C99F6834662D74B0D47E47298D3F02AE6832599BE,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243687Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:11.841{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243686Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:11.841{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E7722459FD9103FC2CC3FEBA713AD780,SHA256=88B2F43A93B0A25640EF9F9B5399C913E121BC7974746B6ACB38993FC3F80EBA,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243690Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:12.854{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243689Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:12.853{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8BDE54C9571E0D07EF9C57DC28646CB0,SHA256=753FC6E2C17D281195492660D0A2E06DC0C12976B08E18BFE78C40541BA91104,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243688Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:09.629{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56220-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243692Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:13.959{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243691Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:13.959{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=636FD7BFF89886B5D55675665EEEC076,SHA256=083E74F89ABDC8446C37625107DBB7CF0B4D944A0759EFDE4C339A02EDF615F7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243694Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:15.067{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243693Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:15.067{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F69181C73F42B44B1CD54A7CB95ED391,SHA256=9AFE231CE3973EBF21E76D22BB03AAD02FA5F7005A18F8BC1661364A78C866B2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243696Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:16.071{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243695Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:16.071{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=41EC1D152BEC1FFDA1B14E82BB9AC336,SHA256=499C893889877B5898D63B0A12DA97955E98D135B2EEDEFEDB6B34E7A2DC2FB0,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243698Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:17.175{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243697Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:17.175{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83EB6253F9BA0BF9AE093DE89B777E07,SHA256=EAFA01E75AA3B246AD27EF385B8A20BA0E44FBC269C6E70A67B903E986D35963,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243701Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:15.509{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56221-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243700Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:18.278{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243699Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:18.277{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E31A6E6747756C74393EED62BF4E5E86,SHA256=B2A1AAB803F52F9B7C80164016CD83A6CA63473EB5AE8923D8623CF04D1411E3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243703Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:19.283{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243702Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:19.283{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E084D86A1EE7836229BC4C4F1B16C05,SHA256=7FF2A44659CC4D460E0269D396903E26456976D09592283EEAB27BD454208E29,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243705Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:20.385{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243704Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:20.385{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF3F5E120E599CFF80D61200B5271435,SHA256=7912F20466CDDBE1A1B43F262DDA31C7EDF7D9F4373B73D702145B306BEE16CD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243707Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:21.489{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243706Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:21.488{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC0B0994187D37223B79286BCCC95960,SHA256=F4245C5C58F1CC6CE93DAFF9851BB3F2A0998DBD03A0A17C6ADDE9BF894BCBCF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243709Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:22.493{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243708Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:22.493{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3EF4D7499B7B50FCB3FC5A665C1B741,SHA256=E9D55DC2EE9E166C29A076FE7AD7A29513D640C19CF853246FEA4D5FA479BE82,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243712Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:20.528{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56222-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243711Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:23.596{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243710Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:23.596{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51C9371FDD57128E584695067041B05D,SHA256=594A538715FADEEDB7BC6014648DA9382F9F60BCCFEAFB20BD9992B78C7F29F8,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243714Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:24.602{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243713Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:24.602{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=32EC94766A8F067C9E3EE2EBACC61788,SHA256=707B3625543191BC980B7B37C2269BC424FAD6BF06C6BC1F92032B50476D494F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243716Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:25.707{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243715Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:25.707{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5C2B21AC0C2357C6D1917B04A392A679,SHA256=871839D452F2A9A3097946B0FB7BEB7781CDCF92DEB3FF501517438234246481,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243719Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:26.813{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243718Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:26.813{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1142CA15A52AEB0371C75EE828895EBB,SHA256=F37E5DA52C8C40D59479B8E20FD3D2DC2FB27B0A39514C48D59427B0717CF643,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243717Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:26.086{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:19:26.086 11241100x8000000000000000243721Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:27.917{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243720Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:27.917{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7CB72097707B00A5EA5BCC099AD3153,SHA256=FC5B6D590D17D5A678DCE203EDB8E1B307349F2729F83F588601F5C0784B1C5C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243723Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:28.921{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243722Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:28.921{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8B14ED43ADFF2E30B549D569A3F8DB3,SHA256=7B74B8AA40FD186B4DDDB8ADF1B5A794B1C680F7337620FEAA095936F00A55C3,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243734Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:25.650{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56223-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 534500x8000000000000000243733Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.704{8D845A55-2481-6260-E202-000000004402}3948C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe 23542300x8000000000000000243732Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.566{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=A372D527A0E30F2AB773CA633E5F6C04,SHA256=AA81E5EEE453D203C1C19221D10C1900567659574EBEBC7DD0453A20D2EB4D23,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243731Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.506{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2481-6260-E202-000000004402}3948C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243730Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.504{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243729Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.504{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243728Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.504{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243727Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.504{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243726Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.504{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-2481-6260-E202-000000004402}3948C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243725Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.504{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2481-6260-E202-000000004402}3948C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243724Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:29.504{8D845A55-2481-6260-E202-000000004402}3948C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000243759Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.995{8D845A55-2482-6260-E402-000000004402}1324C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe 10341000x8000000000000000243758Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.993{8D845A55-2482-6260-E402-000000004402}13245868C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 354300x8000000000000000243757Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:27.728{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56224-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000243756Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:27.728{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56224-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 10341000x8000000000000000243755Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.841{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2482-6260-E402-000000004402}1324C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243754Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.840{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243753Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.840{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243752Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.839{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243751Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.839{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243750Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.839{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2482-6260-E402-000000004402}1324C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243749Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.839{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2482-6260-E402-000000004402}1324C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243748Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.838{8D845A55-2482-6260-E402-000000004402}1324C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000243747Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.358{8D845A55-2482-6260-E302-000000004402}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe 11241100x8000000000000000243746Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.311{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000243745Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.311{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5B47AFB63B8505303833536316BF4A77,SHA256=2DD5A250DB3851337460F463C727C1028BD1CC453465D8CDC68B0D7F7354E56C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243744Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.175{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2482-6260-E302-000000004402}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243743Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.173{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243742Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.173{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243741Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.172{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243740Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.172{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243739Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.172{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-2482-6260-E302-000000004402}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243738Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.172{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2482-6260-E302-000000004402}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243737Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.172{8D845A55-2482-6260-E302-000000004402}2948C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243736Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.034{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243735Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.034{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55A62C22E3C199509FDC82583B23BA64,SHA256=693407A2D4A231C550DE83855CEB277463F8EB1D54CF106472D50CD3F81F0AC4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243769Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.834{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2483-6260-E502-000000004402}5508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243768Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.832{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243767Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.832{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243766Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.832{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243765Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.832{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243764Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.832{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-2483-6260-E502-000000004402}5508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243763Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.832{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2483-6260-E502-000000004402}5508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243762Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.832{8D845A55-2483-6260-E502-000000004402}5508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243761Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.145{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243760Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:31.145{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1ED1BF5BF6520B0125C532005F0F850,SHA256=2CB6668BCC9082E5313E9768D1AAFD8446DE9E8BC9C6C5D1EA65ADD63BD4DA5C,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243783Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.519{8D845A55-2484-6260-E602-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 10341000x8000000000000000243782Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.517{8D845A55-2484-6260-E602-000000004402}60402020C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243781Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.363{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2484-6260-E602-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243780Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.360{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243779Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.360{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243778Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.360{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243777Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.360{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243776Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.360{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2484-6260-E602-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243775Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.359{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2484-6260-E602-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243774Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.359{8D845A55-2484-6260-E602-000000004402}6040C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243773Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.252{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243772Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.252{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0068C1492499E622C6FB58D7E326E3EE,SHA256=07D4BE6238AC831ECA99D64885775A95576FF489B45F5AF0083250EFB59D6B32,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243771Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.003{8D845A55-2483-6260-E502-000000004402}5508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 10341000x8000000000000000243770Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:32.002{8D845A55-2483-6260-E502-000000004402}55084676C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 534500x8000000000000000243804Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.859{8D845A55-2485-6260-E802-000000004402}1816C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe 10341000x8000000000000000243803Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.701{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2485-6260-E802-000000004402}1816C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243802Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.700{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243801Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.700{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243800Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.699{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243799Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.699{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243798Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.699{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2485-6260-E802-000000004402}1816C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243797Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.699{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2485-6260-E802-000000004402}1816C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243796Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.699{8D845A55-2485-6260-E802-000000004402}1816C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243795Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.362{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243794Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.361{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5158AB9460342DA11F7E3345B5EA96BA,SHA256=DE88406299B380175261E0CEC964CCA0F2135972F1DBB7BC1A6E55D910F56D25,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000243793Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.189{8D845A55-2485-6260-E702-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe 10341000x8000000000000000243792Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.187{8D845A55-2485-6260-E702-000000004402}48605548C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+610325|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60fe56|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60943|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+9e7f20|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243791Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.025{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2485-6260-E702-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243790Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.024{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243789Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.023{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243788Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.023{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243787Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.023{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243786Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.023{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-2485-6260-E702-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243785Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.023{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2485-6260-E702-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243784Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:33.023{8D845A55-2485-6260-E702-000000004402}4860C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000243807Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:34.469{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243806Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:34.469{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27F355D54B1573E38408E8608E3F16BE,SHA256=D1DF9AF0F1932D6F3368856A98FB5C885DE930B0D9264A53769C9779C18DD6BB,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243805Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:30.674{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56225-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 10341000x8000000000000000243816Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:35.988{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243815Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:35.987{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243814Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:35.987{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243813Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:35.984{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243812Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:35.984{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243811Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:35.984{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243810Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:35.984{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243809Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:35.574{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243808Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:35.573{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61A06095B13B03492182BA2A974EB14D,SHA256=03AD14C1224E96F9D5FCB2E5EC3752C475EDF36FE4D3A40F4FE700A18197693E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243818Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:36.683{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243817Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:36.683{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=158F3E29643A9B81BD74B6F12AFC4DD5,SHA256=6703F3D5465F9EF2DAB9C2E218B76D5C8ACA8AA085F684B1401601A1DBB37629,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243820Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:37.787{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243819Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:37.787{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=670181FFE54D329F8C4D358AC5DBC6B9,SHA256=3DD9A932BFC0130974F8D13C49316EEBD4B1FF64EAF219A03F4BD92E7A547234,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000243829Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:38.956{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4102-000000004402}368C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243828Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:38.956{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4102-000000004402}368C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243827Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:38.956{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4102-000000004402}368C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243826Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:38.951{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4202-000000004402}4852C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243825Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:38.951{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4202-000000004402}4852C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243824Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:38.951{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4202-000000004402}4852C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243823Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:38.951{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1F6C-6260-4202-000000004402}4852C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243822Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:38.793{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243821Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:38.793{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86C39CABDE3E16BB5C86FF4E0AE6F677,SHA256=7DDD12FAA1D598E367B12DFE297B24F5232CEB36A9AFE3419FD59F8414975C44,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243831Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:39.904{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243830Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:39.903{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=577978DF794541CADCB4FFD3D983AC49,SHA256=844E1337D4A39E819807FEECECEB551F4B7C6865D3887ABD91F0BA7F7CF8039C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243858Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.636{8D845A55-1596-6260-0100-000000004402}4SystemC:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSysmonDnsEtwSession.etl2022-04-20 14:16:14.682 11241100x8000000000000000243857Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.631{8D845A55-1596-6260-0100-000000004402}4SystemC:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSysmonDnsEtwSession.etl2022-04-20 14:16:14.682 534500x8000000000000000243856Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.629{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exe 13241300x8000000000000000243855Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:40.628{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigHashSHA256=57DB6ED7481AE48F63BF2AA10CDA81A6C7CDA7782334071B04A9893A9EB2E1BD 13241300x8000000000000000243854Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:40.628{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\ConfigFileC:\Program Files\ansible\AttackRangeSysmon.xml 16341600x8000000000000000243853Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local2022-04-20 15:19:40.628C:\Program Files\ansible\AttackRangeSysmon.xmlSHA256=57DB6ED7481AE48F63BF2AA10CDA81A6C7CDA7782334071B04A9893A9EB2E1BD 11241100x8000000000000000243852Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.627{8D845A55-1596-6260-0100-000000004402}4SystemC:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSysmonDnsEtwSession.etl2022-04-20 14:16:14.682 13241300x8000000000000000243851Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:40.626{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\RulesBinary Data 13241300x8000000000000000243850Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:40.624{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\DnsLookupBinary Data 13241300x8000000000000000243849Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:40.624{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\CheckRevocationBinary Data 13241300x8000000000000000243848Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:40.624{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\HashingAlgorithmDWORD (0x8000000e) 13241300x8000000000000000243847Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:19:40.624{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\OptionsDWORD (0x00000007) 12241200x8000000000000000243846Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:19:40.624{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\Rules 12241200x8000000000000000243845Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:19:40.623{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\DnsLookup 12241200x8000000000000000243844Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:19:40.623{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\CheckRevocation 12241200x8000000000000000243843Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:19:40.623{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\HashingAlgorithm 12241200x8000000000000000243842Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-DeleteValue2022-04-20 15:19:40.623{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exeHKLM\System\CurrentControlSet\Services\SysmonDrv\Parameters\Options 10341000x8000000000000000243841Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.622{8D845A55-159B-6260-0B00-000000004402}636808C:\Windows\system32\lsass.exe{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243840Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.542{8D845A55-1F6C-6260-4202-000000004402}48525432C:\Windows\system32\conhost.exe{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243839Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.539{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243838Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.539{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243837Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.539{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243836Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.538{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243835Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.538{8D845A55-15B0-6260-4F00-000000004402}38204036C:\Windows\system32\csrss.exe{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243834Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.538{8D845A55-1F6C-6260-4102-000000004402}368608C:\Windows\system32\cmd.exe{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+1ace3|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243833Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:40.538{8D845A55-248C-6260-E902-000000004402}4664C:\Program Files\ansible\sysmon\Sysmon64.exe13.01System activity monitorSysinternals SysmonSysinternals - www.sysinternals.com-Sysmon64.exe -c "C:\Program Files\ansible\AttackRangeSysmon.xml"C:\Program Files\ansible\sysmon\ATTACKRANGE\Administrator{8D845A55-15DE-6260-DFBE-070000000000}0x7bedf2HighMD5=8A914CFB7496B8461285C009DD8F5627,SHA256=422EC998FED690C2EC3239A4BB80075F098A9A95CBDFFBC873365B9F7136A02A,IMPHASH=DCF866F4139DD7FF6C0A5D4FA050CD7A{8D845A55-1F6C-6260-4102-000000004402}368C:\Windows\System32\cmd.exe"cmd.exe" /s /k pushd "C:\Program Files\ansible\sysmon" 354300x8000000000000000243832Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:36.631{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56226-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 10341000x8000000000000000243869Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.721{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243868Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.721{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243867Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.721{8D845A55-15DF-6260-9400-000000004402}43241256C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243866Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.718{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243865Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.718{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243864Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.718{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243863Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.718{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000243862Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.051{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000243861Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.051{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2157B80EB3173F86EAEDB27A63D2CACB,SHA256=8155CFE8B2CF828C4B48563C2DD10CFB1246A9430D227751D7CC730125E5A4E9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243860Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.015{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243859Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:41.015{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4C013B33714F091B931D6C7B8BEDC1D0,SHA256=73F4F19BFEC882CFD1FFC99EFA213A344024660A27A89F0E6F0EBB44784C8AEE,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243871Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:42.120{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243870Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:42.119{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=50535C11EE4EDE6707B95F0B3183284E,SHA256=049BC725C731936B8C158A4891FBB0EDF10346C5F6524928F2637DC131238625,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243873Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:43.224{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243872Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:43.224{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A59A0E2E8E5DC7E38AAA61C16D024168,SHA256=4C832A3C30762884D297B703A5388CC36E805E5A4A224BA88FC5A1D6ADBF6332,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243875Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:44.228{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243874Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:44.228{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2E2C0AD687D311F05B0016A1339A477,SHA256=9DBCF2E0B9A0EAA991D0DFEACC85447C695920CAB7F832CF8F35119595A35A9B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243877Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:45.234{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243876Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:45.234{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26C763AE05913511126E47FA7FAABFD5,SHA256=7B35A28DF7DDCBCE894155C07660C8175362FCA3BA80E1253FB640C09949A9F5,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243880Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:46.339{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243879Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:46.339{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E29C6E8494BF164AF64D76F3614F75A,SHA256=ADC7E993BBF17845273306E080F90D19D0B747A3F14F7A6A149143D6395A4C15,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243878Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:42.494{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56227-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243882Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:47.445{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243881Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:47.445{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB35BDB3EA07978B55196124893A027F,SHA256=33DB2A054B57D548B3ADF779B8EE7C372E0735550E4EE96401AF536910206CB5,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243884Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:48.452{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243883Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:48.452{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51E5AA653E5287347BA94BBCCA342AEC,SHA256=43A4C257D588D9D4A638079BFD181B791A1FBAD30ADB35AE19CA43C07B3C5D1F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243886Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:49.555{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243885Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:49.554{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C5EF031FC485DAA6720EB67741897C9,SHA256=125C3C04B92561EAABEDC8DE8353A72EF53535F60F03031C78F33A03E9128D52,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243891Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:50.561{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243890Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:50.561{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6351A79A2A87EFFA19A10C2E3D058D3A,SHA256=C071762CF51F6D64C825809998C8624F98253900734BF8DAF73605414BABAECC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243889Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:50.451{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\respondent-20220420141616-061MD5=8D93873C901538A8B2B909297EDAE7BB,SHA256=9423023AAA5D37B26F7EE3576993D2852CE2F95EF8E5E497C042A8474DDD26FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243888Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:50.450{8D845A55-15B0-6260-4700-000000004402}3580C:\Program Files\Amazon\SSM\ssm-agent-worker.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\respondent-20220420141616-0612022-04-20 15:19:50.450 11241100x8000000000000000243887Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:50.449{8D845A55-15AE-6260-2D00-000000004402}2972C:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\surveyor-20220420141614-0622022-04-20 15:19:50.449 11241100x8000000000000000243895Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:51.666{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243894Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:51.665{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=70C3CB7AE8EDDAE108DEC3726FCEBD6C,SHA256=520C92C21822A73FE362610A21F7574C4C507CC9D3183CE6820AA387A9A4A190,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243893Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:51.451{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\surveyor-20220420141614-062MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243892Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:47.512{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56228-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243897Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:52.769{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243896Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:52.769{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=631BD676C55DE82FDF700770DF6711D9,SHA256=734125FA1BEC2659760BB2D4AF0F6FF1988E23579E56FC6750099B1659B16803,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243901Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:53.874{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243900Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:53.874{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BC22525E222AF213ED5958545283B10,SHA256=58B7630CB5AB487AE6002A9F796A18610F8D419D0BE9DC18DF207FE0F28E6C81,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243899Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:53.138{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000243898Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:53.137{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=B5A04CFAA2E1217A9D83DBBB949624AE,SHA256=8C2A82837CFC632CD82C5FD154DC9411C007AE29F5B49A4D41CD25F245E77F08,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243903Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:54.977{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243902Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:54.976{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=217D2A39D14C300F91D974ADDB93C9CB,SHA256=90D0A6652968BE9464B6EBDB12695BF87E000651FE5D7E437764B4A0E90EBCCD,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243904Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:52.513{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56229-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243907Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:56.095{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:19:56.095 11241100x8000000000000000243906Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:56.092{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243905Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:56.092{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE1226983FB633E9975A99A2BDDD4766,SHA256=3369F8D4AA0FBCE60F9C27A3BA1DE169ABA6D412FB492D5183835D1EE4C72122,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243909Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:57.101{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243908Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:57.101{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04C5F2BB889DA86507D7672B499CE32C,SHA256=D60EF8852DD71FF33ECAA44C1A55175FA153C47B7533CDCCD0D96272DFDB7F14,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243911Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:58.111{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243910Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:58.111{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=602C872E0AC4BC30CCF27930B77E57F3,SHA256=1E59F2488348CC0655C76C7A57540B7EA702CC938A86255ECDEF9F61328236F4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000243916Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:59.803{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=75F7FB372813174633CAD046C59395AE,SHA256=75EDF3B2C170B9015823C0B4031E4314B0707EB1375168C42205A5BF8394EB38,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243915Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:59.274{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat2022-04-20 14:15:57.498 23542300x8000000000000000243914Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:59.273{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=BF5A44F858DB0E141C37B5D630B62796,SHA256=32AD00F7D17E72BEC8F00F4F597BC0B07F05679FD51984D7F43935448DDDB725,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243913Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:59.214{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243912Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:59.213{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8215A15621AEC49A936FCEF623662580,SHA256=EB5279925C3AB4BF969D6A16B6C886A5DF3215994D1A52B22183436E335970A0,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243918Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:00.320{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243917Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:00.319{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=235BBC5092EDE5D5A18DF5D903F2655B,SHA256=99D4850B2160AE275AE1FEB712C9C079B77DE1116C158C7B7351B481238FA4D2,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243921Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:19:57.568{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56230-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243920Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:01.324{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243919Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:01.324{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB06538096253D0BB92AA6C2B5633E5C,SHA256=462C17A5DB607C2B4453C7D98FA86F0AF966911C22D6840756ED090AD4C4D06D,IMPHASH=00000000000000000000000000000000falsetrue 734700x8000000000000000243968Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.509{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=203F58BA41B48A59D6A047E0233DB422,SHA256=4204F7C2B4E13AA3819A180FACA724435F6400FE97D2EF6C74634A0D7E51F7F3,IMPHASH=EA6E499F92F9040E9609EFDC47BE01FEtrueMicrosoft WindowsValid 734700x8000000000000000243967Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.507{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=7BC54AA66588A3DF7B1448A4493C6663,SHA256=9CB1BA7C092164DAA14E21454606905E294D137AD72158F92A666077D7CF1946,IMPHASH=2DCB08A6E31A83C3EA33C5793EFA9A56trueMicrosoft WindowsValid 734700x8000000000000000243966Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.507{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=0D885953D657434CA5015545A364BDB9,SHA256=1D29921E136F84B4CA9F1EBD646CFFF4571EA805A6CC5BC1F7C7784CC3246088,IMPHASH=76F056ED62EDF4D48793D8C5EDA733ADtrueMicrosoft WindowsValid 734700x8000000000000000243965Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.507{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=CA6447DDCA724F0C5C0CAFDE184EFE64,SHA256=F9664337B60A332571FCA81CC3E6DD194DCE20C8546980FD283CA892D0CC873C,IMPHASH=6E3C4DB87F2B77C788E86C1A678A8D0DtrueMicrosoft WindowsValid 734700x8000000000000000243964Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.507{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=E3851CE4A433475612CB0E1552A733E3,SHA256=F391BAA7AFF5734842737FC1B4C58856BA5E409A7B97C037995F0F26150A85FA,IMPHASH=6DF3E31673D2CCEDABFBE5A79390B72DtrueMicrosoft WindowsValid 734700x8000000000000000243963Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.506{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=4BA1C50E6607AE70495B58874963B901,SHA256=72BBBB4145E058C3B12504AC0EC128CD44E282D40959D018192899276A2B9C69,IMPHASH=9F60CD6001B5CEA647B250DFF3B6F65AtrueMicrosoft WindowsValid 734700x8000000000000000243962Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.506{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=AF2A9437F3AED2E8254B7E1EB6E96782,SHA256=D8F3C957BDBD9DB510E71B07CDE1B446491D4DC520787548060B3AAD1324C62A,IMPHASH=5D2578ED274AAD83C30A3917C98404EEtrueMicrosoft WindowsValid 734700x8000000000000000243961Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.506{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=318804DFF282AE5C2FEF5577057CB913,SHA256=A65C5C3F38A793F0C59C1A4553940D6D236CE2BC3380898E865BF0E1F80FEE8C,IMPHASH=5D92B73B6930EFBC71A36B7FEF62DF62trueMicrosoft WindowsValid 734700x8000000000000000243960Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.506{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=AB5AE3CC1EAA79B84589257A14BC2480,SHA256=BD0216233D84012BD61BE38964798F8F6686DA61E2E8E04D1B395AB8566CA084,IMPHASH=E698C8E2E06172CDB524686FF10A5C5EtrueMicrosoft WindowsValid 734700x8000000000000000243959Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.505{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=E9E209227AF7EFBFDAAA0B932251486D,SHA256=639DD063669F506790DA8C940E3BEBE4F7CF31668260F94CF5A67C93021D2BDF,IMPHASH=25AFDCBDCE8BEB6A7109D378495BE552trueMicrosoft WindowsValid 734700x8000000000000000243958Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.505{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=0FDEB9236FF287E329F2EF155BA8AE56,SHA256=5F0C2A29312C82D14B8B42D2B6AAFEB82EBAD20822B603FD162E6AAF39B06C95,IMPHASH=2D7046CEF5DEEA9D960D37CB0A98F146trueMicrosoft WindowsValid 734700x8000000000000000243957Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.505{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=0887C15A40AA6286ABACDF5FA5EADFC8,SHA256=C031E35864A113C505E5E1CCBF9BE34164823C67E41604A60276D1B89ACE08D7,IMPHASH=8B861EA72FDD6FC722328B2746B13380trueMicrosoft WindowsValid 734700x8000000000000000243956Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.505{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=A6F22CA344FD1B7D75D49ECC718693C8,SHA256=C7787F59263B7D5246B931531AB4DC4C430E1BF8260775B7A751D4994A5D3489,IMPHASH=689E2A5805AE9CF0919D2DDDDDC411CCtrueMicrosoft WindowsValid 734700x8000000000000000243955Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.504{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=F058FE3C5E3DEF875A654A18551D88E5,SHA256=78DC0394AA359DBD2EB8BE7F13FEDF0478C8AA55785712B358FAC1C97D051B87,IMPHASH=44F906D172B935DEA0C5D038C6FA8449trueMicrosoft WindowsValid 734700x8000000000000000243954Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.504{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=8DC8BE73A389A78CF0712855FEB95E19,SHA256=28353CA8EB08D784E8188E2785C97173CEADCA7B6A2202020E03F1082AF8CCB0,IMPHASH=7E0E904C0FD68DBF5F794D700C0C3C3DtrueMicrosoft WindowsValid 734700x8000000000000000243953Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.504{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\windows.storage.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=B477727DF2138332841E3C16E0034DA8,SHA256=21D453AECB117F73628A97F35397C67C21AB44266295C8902BA096840FEEE69D,IMPHASH=27EE2F560EBD20EF5BFF92A874046DACtrueMicrosoft WindowsValid 734700x8000000000000000243952Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.502{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=90A1CD387F9CB30F86D34B88BFCD83A1,SHA256=5F6CE9777CDC7B0A0E98C90709C41C379415DBA654A39B332BB683A7F2B86E97,IMPHASH=07C997EFB887CE39B75B7896A20F5FFBtrueMicrosoft WindowsValid 734700x8000000000000000243951Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.502{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=F3B7F231407DD207CABC94C9347984AC,SHA256=053A1D95EEB426416278D2AD7D584FDD984A8B445CC88B46785AB8666383FB0B,IMPHASH=B5CBF1B1B5086E2C500FD84325E04D44trueMicrosoft WindowsValid 734700x8000000000000000243950Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.502{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\shell32.dll10.0.14393.5006 (rs1_release.220301-1704)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=D1B932F51A706F52D3A8DF0B2F996690,SHA256=DFF697BB21D32C38EFE7E1FEA7E5636BD0362FDC8DFBEEA74DBE8A7DE23925CE,IMPHASH=66F8E3D81FC635E47987E2D0CB03F594trueMicrosoft WindowsValid 734700x8000000000000000243949Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.502{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=6215B591FCA75825262B29613A48836C,SHA256=B34EED73CE76E4AA1A0812E9BE1AE093549B164341F988CA877E27E545C3C1B8,IMPHASH=918DADABE6E41CFBB03F954A46D3F72EtrueMicrosoft WindowsValid 734700x8000000000000000243948Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.501{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=3D4308BAC53B881B16D9BD1006ABDC65,SHA256=26DF85FC22F9FCAA2212CB66612FE8F5CC6382953FE81B9C34128E43080C7891,IMPHASH=C7D6B46400E43E7BE538D1CCB512EC25trueMicrosoft WindowsValid 734700x8000000000000000243947Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.501{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\sspicli.dll10.0.14393.5006 (rs1_release.220301-1704)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecurity.dllMD5=1B90C58145F4B3C0743C470793469AD6,SHA256=21D752964E10DBB4DFC589856AA808D31E301B93C9E5FF6D1655D32FBD00AF44,IMPHASH=AC11100B3FFA7FCAFA188E618E4C7CC1trueMicrosoft WindowsValid 734700x8000000000000000243946Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.501{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=E23B1EE95FE19AD57E8DA6F59EED5095,SHA256=E076E77F0B2D9A5D5FD8F147443456F044FBC19368FDC962560517BDF29B04D0,IMPHASH=991572CE3F59EDD28F428DD5C4D9E67DtrueMicrosoft WindowsValid 734700x8000000000000000243945Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.501{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=495127E6E6D5CAEDE18A809EAEFFC349,SHA256=9F621D36BCD75AE97E1BCBA9BBFD75FEC74C6CA87AEF81F3190173CBF7CC2A45,IMPHASH=C3B61C1F5D46A607D624033E7094E4FFtrueMicrosoft WindowsValid 734700x8000000000000000243944Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.500{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=89AC96525FB527CDF4FFDCDF657A3923,SHA256=737BC5E7586D9AB6306949B1470DB3DBE576638A010EEF7A297126BE30841C2F,IMPHASH=844732D10340F10C1E97778BA10CF30EtrueMicrosoft WindowsValid 10341000x8000000000000000243943Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.500{8D845A55-1E5C-6260-0F02-000000004402}31442700C:\Windows\system32\conhost.exe{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000243942Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.498{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=310F71ED43C168BF43B3825696E8224C,SHA256=F92555518BD8EC07DAD2BFBD3B97C4D47AD987EA4C89BA7D01775AB97CC6CB5F,IMPHASH=6E1D0A92C1917EFBFC1EEA82FA5E155FtrueMicrosoft WindowsValid 734700x8000000000000000243941Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.498{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=B7507287901F3605BC754109D6EA1B04,SHA256=7E2697685399C687ABB501AE3A6F19EAA50E5C0457F8FEFAC87C05F0C0F31DB1,IMPHASH=EAF4CC449835E7A81A8EEFEBEB2E8FC7trueMicrosoft WindowsValid 734700x8000000000000000243940Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.494{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\System32\wow64cpu.dll10.0.14393.3503 (rs1_release.200131-0410)AMD64 Wow64 CPU Microsoft® Windows® Operating SystemMicrosoft Corporationwow64cpu.dllMD5=C1F2078639481364EA3FDD10CBEB1A18,SHA256=B63E6DC0B3D7ABA9CB95929A1A360208A570CB2072474276F649B68F1AC8DC82,IMPHASH=15CD876FB3F6EC97A2F7466360415F86trueMicrosoft WindowsValid 734700x8000000000000000243939Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.494{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000243938Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.494{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000243937Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.493{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=B7507287901F3605BC754109D6EA1B04,SHA256=7E2697685399C687ABB501AE3A6F19EAA50E5C0457F8FEFAC87C05F0C0F31DB1,IMPHASH=EAF4CC449835E7A81A8EEFEBEB2E8FC7trueMicrosoft WindowsValid 734700x8000000000000000243936Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.493{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000243935Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.493{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\System32\wow64win.dll10.0.14393.3383 (rs1_release.191125-1816)Wow64 Console and Win32 API LoggingMicrosoft® Windows® Operating SystemMicrosoft Corporationwow64lg2.dllMD5=62DEBA17D0A26B352F1C3F02144BC6EA,SHA256=5A1C08FE318942CB31048DBD641E25610DE842E34470B3E54FEDCA4E2642D4E0,IMPHASH=3045357B61B63AEF6CBCD96F2FA7E9D8trueMicrosoft WindowsValid 734700x8000000000000000243934Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.492{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\System32\wow64.dll10.0.14393.3503 (rs1_release.200131-0410)Win32 Emulation on NT64Microsoft® Windows® Operating SystemMicrosoft Corporationwow64.dllMD5=447615F19DAAFF9C308370C59F493BF8,SHA256=45ED2009CEEB249BBF518B958AF02B97E667DB68C9B6D65642E69E9B0300CF5D,IMPHASH=03B9E38A9E88FDC66380837CCC8647FAtrueMicrosoft WindowsValid 734700x8000000000000000243933Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.492{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=B04953E4C38042AD2628FA49AB42AB5C,SHA256=7B2B4662D3EE0D6DD673C0FEEE4B28E2E16ABF534DF3076497C6B6B40E8BE9C1,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000243932Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.492{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000243931Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.491{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Temp\OIK\Temporary0\industroyer2.exe------failed: Invalid hash-- 10341000x8000000000000000243930Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.491{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243929Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.491{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243928Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.491{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243927Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.490{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000243926Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.490{8D845A55-15B0-6260-4F00-000000004402}38204036C:\Windows\system32\csrss.exe{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000243925Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.490{8D845A55-1E5C-6260-0E02-000000004402}50682320C:\Windows\system32\cmd.exe{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\system32\cmd.exe+f1e1|C:\Windows\system32\cmd.exe+11a37|C:\Windows\system32\cmd.exe+cb0d|C:\Windows\system32\cmd.exe+c295|C:\Windows\system32\cmd.exe+1ace3|C:\Windows\system32\cmd.exe+1510d|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000243924Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.490{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exe-----industroyer2.exe -t 21C:\OIK\Temporary0\ATTACKRANGE\Administrator{8D845A55-15DE-6260-DFBE-070000000000}0x7bedf2HighMD5=90646F6A56D4F84F13B73D365CA5E4D8,SHA256=5D689C6078A30EB1E458FFB27694AB1C1D085085E9978CDDB5122A85D40CB33F,IMPHASH=2CF6FF919D8AF9170B36D01B351744F3{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\System32\cmd.exe"cmd.exe" /s /k pushd "C:\OIK\Temporary0" 11241100x8000000000000000243923Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.428{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243922Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:02.428{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=699886B97FDF6CE4387D898287AB52D3,SHA256=CE2CF17CEB908CC2889C8AB4E3CC40B4E99210F5E4246528B51AAC88E07588AC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243974Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:03.935{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243973Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:03.935{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F75C9349CB23C696B8257D6146AE943,SHA256=F9297CC84F98D38E2330D7BEB6AAD6A51A44F772441408F30EB507FA31CF8FE9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243972Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:03.518{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000243971Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:03.518{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4A7CC47ABC4D515ED2321BBE5DE5430E,SHA256=B1AB66E1E6FCA76C0FD47B5D2B88B71EDFC82E87871161225195170062314D3A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243970Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:03.340{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000243969Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:03.339{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000243977Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:20:04.568{8D845A55-159D-6260-1200-000000004402}504C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d854ca-0x1c7fa035) 11241100x8000000000000000243976Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:04.554{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243975Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:04.554{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79ADDDB082E157637DBEAC7DB704DEFD,SHA256=4A2C6E9A6590521ABF0F1A1ED6181B770AEAE6E743DAAD2814CDF0FEEB37CCCF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243980Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:05.657{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243979Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:05.657{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DF36AEED034B5EBBD560723744B5F1FC,SHA256=1A5A42D019876D547380CD127A4E763D081BC83BB878E7BA45727A67CD3DCC15,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243978Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:01.762{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56231-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8089- 11241100x8000000000000000243983Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:06.660{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243982Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:06.660{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63F181E47D1CF35ED60BB39C6654E77E,SHA256=EFF15BB60A6DA1500EE3A6D172D1E4AC2C124F045E9F6E0129234E2BDF39EF60,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243981Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:03.439{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56232-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243985Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:07.765{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243984Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:07.765{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47F398259829BF24A20492FA339C73CF,SHA256=B804877BA79778B966C3BFFD90E2F2A82AAAA36B8287D17D165DF13D132A02CE,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243987Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:08.772{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243986Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:08.771{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=638CFD4891817B97A19E2FA40D426ED9,SHA256=28309F19C560D10F7A24618112ED29EB81B2926E04598366CE8CA495C1C10D5A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243989Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:09.876{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243988Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:09.876{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73C8D515CA1A04CE9A326186FF8B557E,SHA256=5ED723756BBEEA24F6788D23F44DBB07022A0AC0470B8F8F99E11393A2200CA2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243991Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:10.980{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243990Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:10.979{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE9C5E9ED041024B7FD979D4E8C5CB7D,SHA256=B70DB68AE4095436AA162DA8C8D3E47E66831C257FA10DBEC36CD815E50C0074,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000243994Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:09.439{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56233-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000243993Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:12.085{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243992Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:12.085{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBCB60FF4BA1728964BC229D5073F6B6,SHA256=7392CD49263F6EC4AE6ED108BE722B314D5C5D277D65287ED74EB0DEEF0E1D4F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243996Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:13.189{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243995Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:13.188{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C766175A031707DD2FC0869B7B745611,SHA256=4A419A3FA876FA19A4820980F0CCBCB398D9516666B59B3849FC89552200A793,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000243998Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:14.292{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243997Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:14.292{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8702251B7A9E7320FE4ADD877B4EC01,SHA256=4B61EDBD69A8CF17E76F766FFA026CABA827474F5BA706A922AB925224898CD8,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244000Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:15.397{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000243999Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:15.396{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DDBBB49367FE1054A4CD442C8D343110,SHA256=F557034C04BB2ACF70C1DA69EF2597E933314455B333A4D82AB94DFAF6FD3AEF,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244004Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:16.502{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244003Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:16.501{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=710B9C54450A82B7C538E0A79CC3DC0E,SHA256=4EBA8C81E006E85041CE6E3B06F151AD915AD859983832AC613E76B4088AE24D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244002Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:16.182{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000244001Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:16.182{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=BD2B37161D27CDDA68DFFCA948E8D04B,SHA256=880BCFD44B7FB725BE59D9506501EC08C532FC4A0A8BACBF810DFD024A047F8B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244007Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:17.505{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244006Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:17.505{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9B2E0F8A9B86C969007925D53A99B9C0,SHA256=DCE42D0EDBC3FD2892AC34EC50821465D2EA926BB416FBF49FB0C5A1335B6DF5,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244005Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:14.499{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56234-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244009Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:18.611{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244008Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:18.611{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C34751CFEB19893DE4A44D66F2D24FE,SHA256=C9DABEF4279D299F801BE867306AE53DFC99E7160DAEDF079E130579AE15078C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244013Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:19.716{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244012Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:19.715{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E64303030C2004F51E4CE8369B7BCDF2,SHA256=83A41660EEDDC3B59B595761B34BFF45B60E59BD8A83E09D2E324E2DA2F08350,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244011Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:16.595{8D845A55-1596-6260-0100-000000004402}4SystemNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.255-138netbios-dgmfalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local138netbios-dgm 354300x8000000000000000244010Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:16.595{8D845A55-1596-6260-0100-000000004402}4SystemNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local138netbios-dgmfalse10.0.1.255-138netbios-dgm 11241100x8000000000000000244015Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:20.818{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244014Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:20.818{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B22F078495F1FE2C3A6BA6CB0BE34EAD,SHA256=4EFA6FD63DB36A301D732E4E7610D7A9C6AEDCE81FB0D98A711E243E3059D1A5,IMPHASH=00000000000000000000000000000000falsetrue 734700x8000000000000000244087Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.891{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exeC:\Windows\System32\winbrand.dll10.0.14393.4530 (rs1_release.210705-0736)Windows Branding ResourcesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinbrand.dllMD5=79E4DAD0DB8F0D1258F7092007354241,SHA256=DDFCF94DA71C8F49DC505F2FC94540037A0955BE831BF59C34BFBB62A998FB20,IMPHASH=2C424150D7AE913E28B879B06042C9F2trueMicrosoft WindowsValid 734700x8000000000000000244086Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.889{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x8000000000000000244085Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.878{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244084Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.878{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244083Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.878{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244082Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.875{8D845A55-15DF-6260-8F00-000000004402}49245084C:\Windows\system32\taskhostw.exe{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cd4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244081Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.872{8D845A55-15DF-6260-8F00-000000004402}49245084C:\Windows\system32\taskhostw.exe{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cd4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244080Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.863{8D845A55-15DF-6260-9400-000000004402}43246000C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244079Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.863{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 10341000x8000000000000000244078Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.863{8D845A55-15DF-6260-9400-000000004402}43246000C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244077Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.863{8D845A55-15DF-6260-9400-000000004402}43246000C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244076Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.862{8D845A55-15DF-6260-9400-000000004402}43246000C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244075Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.861{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244074Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.861{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244073Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.861{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244072Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.861{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244071Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.857{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x8000000000000000244070Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.856{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 10341000x8000000000000000244069Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.852{8D845A55-159D-6260-1600-000000004402}12922392C:\Windows\system32\svchost.exe{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244068Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.852{8D845A55-159D-6260-1600-000000004402}12921356C:\Windows\system32\svchost.exe{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6144|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244067Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.852{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x8000000000000000244066Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.851{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x8000000000000000244065Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.851{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000244064Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.850{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x8000000000000000244063Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.850{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000244062Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.850{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x8000000000000000244061Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.850{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\windows.storage.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=0B1961C1D14DD3DE4342B6E7BCE700BC,SHA256=AADDD62E881A6A91A67EA1263798F4608DCEA6F59AE43A076880B2A621E2ED63,IMPHASH=A03B8A6BEC68C432E677F3D5E1DA4FAFtrueMicrosoft WindowsValid 734700x8000000000000000244060Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.849{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x8000000000000000244059Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.849{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\shell32.dll10.0.14393.5006 (rs1_release.220301-1704)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=CC49EC90F89D864201C457C480E62211,SHA256=731D0F819FAFEA355604D22AE73208DC15D82CE44B6BD6DF7184185B88145300,IMPHASH=CE6A42C292DA87885FAB409381075FA7trueMicrosoft WindowsValid 10341000x8000000000000000244058Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.848{8D845A55-24B5-6260-EC02-000000004402}59605804C:\Windows\system32\conhost.exe{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244057Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.846{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x8000000000000000244056Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.846{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244055Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.846{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x8000000000000000244054Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.845{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244053Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.845{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244052Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.845{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x8000000000000000244051Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.844{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244050Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.844{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244049Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.844{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244048Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.844{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244047Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.844{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244046Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.843{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244045Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.843{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244044Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.843{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244043Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.841{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\ConhostV2.dll10.0.14393.4886 (rs1_release.220104-1735)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=90A1061677CEBBF9FF41283BBDFD851C,SHA256=01448DC953A0E6B96CDACA05EDDFB2FF053DA488F258600745AAE4FE840B4682,IMPHASH=8186D8B119B7234AAF75B4C29E77630DtrueMicrosoft WindowsValid 734700x8000000000000000244042Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.841{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244041Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.840{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\System32\svchost.exeC:\Windows\System32\deviceaccess.dll10.0.14393.4283 (rs1_release.210303-1802)Device Broker And Policy COM ServerMicrosoft® Windows® Operating SystemMicrosoft CorporationDeviceAccess.dllMD5=BE5D6961F4736274AD28D2B2BAF0CF50,SHA256=177BF5B04802C472A158EC012FF03055E74FC7121F47DAE0D6BF0FD9579F6A1E,IMPHASH=1F40F992028A58CCA9DFDD62028D0D40trueMicrosoft WindowsValid 10341000x8000000000000000244040Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.840{8D845A55-15B0-6260-4F00-000000004402}38202388C:\Windows\system32\csrss.exe{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cd4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5179f 734700x8000000000000000244039Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.840{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\explorer.exeC:\Windows\System32\LocationFrameworkPS.dll10.0.14393.4169 (rs1_release.210107-1130)Windows Geolocation Framework PSMicrosoft® Windows® Operating SystemMicrosoft CorporationLocationFrameworkPS.dllMD5=9BA4CCDCED268D654794C53AD79F1402,SHA256=4778C3E478FC613C7B97FBCE5716F04F36CA665F643541841EB24A38B0AAB4A1,IMPHASH=BDE6E9F55B678D4E2440D9FA0C8B81FBtrueMicrosoft WindowsValid 734700x8000000000000000244038Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.839{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244037Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.839{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244036Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.839{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\System32\svchost.exeC:\Windows\System32\LocationFrameworkPS.dll10.0.14393.4169 (rs1_release.210107-1130)Windows Geolocation Framework PSMicrosoft® Windows® Operating SystemMicrosoft CorporationLocationFrameworkPS.dllMD5=9BA4CCDCED268D654794C53AD79F1402,SHA256=4778C3E478FC613C7B97FBCE5716F04F36CA665F643541841EB24A38B0AAB4A1,IMPHASH=BDE6E9F55B678D4E2440D9FA0C8B81FBtrueMicrosoft WindowsValid 734700x8000000000000000244035Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.838{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244034Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.838{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe10.0.14393.0 (rs1_release.160715-1616)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=D752C96401E2540A443C599154FC6FA9,SHA256=046F7A1B4DE67562547ED9A180A72F481FC41E803DE49A96D7D7C731964D53A0,IMPHASH=2C980A4DA7C717CC670CB9E1D2C4D733trueMicrosoft WindowsValid 10341000x8000000000000000244033Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.833{8D845A55-159D-6260-1000-000000004402}3405556C:\Windows\System32\svchost.exe{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244032Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.832{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\explorer.exeC:\Windows\System32\deviceaccess.dll10.0.14393.4283 (rs1_release.210303-1802)Device Broker And Policy COM ServerMicrosoft® Windows® Operating SystemMicrosoft CorporationDeviceAccess.dllMD5=BE5D6961F4736274AD28D2B2BAF0CF50,SHA256=177BF5B04802C472A158EC012FF03055E74FC7121F47DAE0D6BF0FD9579F6A1E,IMPHASH=1F40F992028A58CCA9DFDD62028D0D40trueMicrosoft WindowsValid 734700x8000000000000000244031Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.832{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 11241100x8000000000000000244030Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.832{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 734700x8000000000000000244029Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.831{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 23542300x8000000000000000244028Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.831{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9FB57EF64D09896850CA1603D11FD879,SHA256=959858FE9815F38C4859AE1B8294989E8C3993B28277DBC96B20C16D4E68FC91,IMPHASH=00000000000000000000000000000000falsetrue 734700x8000000000000000244027Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.831{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244026Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.830{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exeC:\Temp\OIK\Temporary0\PServiceControl.exe------failed: Invalid hash-- 10341000x8000000000000000244025Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.830{8D845A55-159D-6260-1000-000000004402}3405556C:\Windows\System32\svchost.exe{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244024Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.830{8D845A55-159D-6260-1000-000000004402}3401108C:\Windows\System32\svchost.exe{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\pcasvc.dll+52e4|c:\windows\system32\pcasvc.dll+58a9|c:\windows\system32\pcasvc.dll+5b49|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3530e|C:\Windows\System32\RPCRT4.dll+20c87|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244023Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.830{8D845A55-159D-6260-1000-000000004402}3401108C:\Windows\System32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1440C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3530e|C:\Windows\System32\RPCRT4.dll+20c87|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244022Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.829{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244021Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.829{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244020Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.829{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244019Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.829{8D845A55-15B0-6260-4F00-000000004402}38202388C:\Windows\system32\csrss.exe{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244018Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.829{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244017Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.828{8D845A55-15DF-6260-9400-000000004402}43241068C:\Windows\Explorer.EXE{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+16e70b|C:\Windows\System32\windows.storage.dll+16e421|C:\Windows\System32\windows.storage.dll+16e06e|C:\Windows\System32\windows.storage.dll+16f310|C:\Windows\System32\windows.storage.dll+16ddbe|C:\Windows\System32\windows.storage.dll+fce7d|C:\Windows\System32\windows.storage.dll+fd5bc|C:\Windows\System32\windows.storage.dll+fc920|C:\Windows\System32\windows.storage.dll+1664ca|C:\Windows\System32\windows.storage.dll+166222|C:\Windows\System32\SHELL32.dll+9cf3d|C:\Windows\System32\SHELL32.dll+9bad6|C:\Windows\System32\SHELL32.dll+d9be1|C:\Windows\System32\SHELL32.dll+c0bbe|C:\Windows\System32\SHELL32.dll+18d1bc|C:\Windows\System32\SHELL32.dll+18cf13|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244016Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:21.828{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\OIK\Temporary0\PServiceControl.exe" C:\OIK\Temporary0\ATTACKRANGE\Administrator{8D845A55-15DE-6260-DFBE-070000000000}0x7bedf2HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 11241100x8000000000000000244094Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:22.863{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244093Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:22.863{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D91C1982BC48606456DE72ACF0C340C,SHA256=D642B6DE8F947360B700B08F7474E3D49333D8A96229ECC496F7313F18284D4E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244092Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:22.862{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000244091Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:22.862{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C5ED9E935BE9F7360E27E7C277E50838,SHA256=0BC8C21C41A020EC1CC96FC4FB7678659FC588E89DD5756A6E42534B722ECE48,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244090Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:19.648{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56235-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244089Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:22.243{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244088Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:22.243{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C0EED56C2F9F5A4F4120BDD29EA2DB4,SHA256=D54F8B6CF9DD67D8BB723A3531F758AB4CD5832290835155F714B2D4157DCD5E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244096Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:24.172{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244095Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:24.171{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7ADB84D252CCA8BFF651FC3BED78B2C1,SHA256=F14A18EB62D0E7418DF68503C31A183A62E868EA3C4A73D647E92D341BE32DBE,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244098Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:25.277{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244097Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:25.277{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5087EF0243951881220BACEF481D4E0A,SHA256=B762FE37E54216DDAD140EEDFD72D1135E95E2EA7BC0E72EF753849EC2A5A381,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244101Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:26.381{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244100Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:26.381{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7719A8B921C9A44D396808FC29C38F78,SHA256=46F8459A4149107A0B5AF5BFF67386B55A70BD4C330EFE99CF157C24A252A708,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244099Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:26.094{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:20:26.094 11241100x8000000000000000244139Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.836{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244138Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.836{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=81C926E0FBF035FA6A431702EA15C1FF,SHA256=0D281B11104F3B7815E611A0C385AD4F36C2F16F15385A620E570B9E4E9296F9,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244137Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:24.658{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56236-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 10341000x8000000000000000244136Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.262{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244135Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244134Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244133Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244132Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244131Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244130Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244129Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244128Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244127Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244126Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244125Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244124Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244123Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244122Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244121Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244120Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244119Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.261{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244118Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244117Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244116Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244115Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244114Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244113Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244112Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244111Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244110Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244109Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244108Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244107Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.260{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244106Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.259{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244105Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.259{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244104Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.259{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244103Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.259{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244102Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.259{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000244209Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.855{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244208Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.855{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7690A40C9245FCD1833E14DB2AC439BF,SHA256=FD1D8A89EF2BD666BB6099155C209718A2F10AD79D62EBAD79074BFC9B203CDA,IMPHASH=00000000000000000000000000000000falsetrue 734700x8000000000000000244207Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.655{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exeC:\Windows\System32\winbrand.dll10.0.14393.4530 (rs1_release.210705-0736)Windows Branding ResourcesMicrosoft® Windows® Operating SystemMicrosoft Corporationwinbrand.dllMD5=79E4DAD0DB8F0D1258F7092007354241,SHA256=DDFCF94DA71C8F49DC505F2FC94540037A0955BE831BF59C34BFBB62A998FB20,IMPHASH=2C424150D7AE913E28B879B06042C9F2trueMicrosoft WindowsValid 734700x8000000000000000244206Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.653{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x8000000000000000244205Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.643{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244204Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.643{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244203Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.642{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244202Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.639{8D845A55-15DF-6260-8F00-000000004402}49245084C:\Windows\system32\taskhostw.exe{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cd4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244201Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.636{8D845A55-15DF-6260-8F00-000000004402}49245084C:\Windows\system32\taskhostw.exe{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cd4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d812|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244200Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.626{8D845A55-15DF-6260-9400-000000004402}43246000C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244199Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.626{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.4169_none_7de0bbf28341b1f2\comctl32.dll6.10 (rs1_release.210107-1130)User Experience Controls LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationcomctl32.DLLMD5=FD486B6FA360ABE43E02E85F3164E9BE,SHA256=733922A216EC03FC6AA405205CD2F8BB81A39180F26839588B97F310E21071B5,IMPHASH=C3F4A4DA2950075F09DD008B60FF567CtrueMicrosoft WindowsValid 10341000x8000000000000000244198Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.626{8D845A55-15DF-6260-9400-000000004402}43246000C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244197Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.626{8D845A55-15DF-6260-9400-000000004402}43246000C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244196Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.626{8D845A55-15DF-6260-9400-000000004402}43246000C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244195Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.625{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244194Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.624{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244193Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.624{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244192Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.624{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244191Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.620{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\dwmapi.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft Desktop Window Manager APIMicrosoft® Windows® Operating SystemMicrosoft Corporationdwmapi.dllMD5=74621C6ABE4E9A568DF0A38E7282D71E,SHA256=0788A092D47800D0EB120A7DBB9E59234D0722A4A2E80ECE6CE70E3A84A3750A,IMPHASH=ADB9F71ACD4F7D3CF761AB6C59A7F1E5trueMicrosoft WindowsValid 734700x8000000000000000244190Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.619{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\msctf.dll10.0.14393.4530 (rs1_release.210705-0736)MSCTF Server DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationMSCTF.DLLMD5=E2374A214A9F0C8347C29EBDE3447986,SHA256=F2260FE7E0C4E92D49CF0F550E2A1B3D3F1D2D76E6F5C8F16B0E16B6117D9EE1,IMPHASH=EB898F83C3A5D6877A523BC64B41CB06trueMicrosoft WindowsValid 10341000x8000000000000000244189Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.615{8D845A55-159D-6260-1600-000000004402}12922392C:\Windows\system32\svchost.exe{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244188Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.615{8D845A55-159D-6260-1600-000000004402}12921356C:\Windows\system32\svchost.exe{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6144|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244187Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.615{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\uxtheme.dll10.0.14393.4169 (rs1_release.210107-1130)Microsoft UxTheme LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationUxTheme.dllMD5=43AEE61AFABE70BFC876CC53D6A64E04,SHA256=8A4C893AEB075D3D9EFEC52E49CEF94471EB9F0A91BEB4C07DF38F8A48910C12,IMPHASH=67E6A4C8E164C0229E3FF1626F1894C6trueMicrosoft WindowsValid 734700x8000000000000000244186Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.614{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\profapi.dll10.0.14393.0 (rs1_release.160715-1616)User Profile Basic APIMicrosoft® Windows® Operating SystemMicrosoft CorporationPROFAPI.DLLMD5=0BC84513575743DA177F3DFE18D35CA7,SHA256=C40F6AA73073995E05E5379AE593A6617E8296C79A78BD7F716D95F98AE0D899,IMPHASH=9060609FCB6C4120D4517877408A4A46trueMicrosoft WindowsValid 734700x8000000000000000244185Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.613{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000244184Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.613{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\shlwapi.dll10.0.14393.4169 (rs1_release.210107-1130)Shell Light-weight Utility LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationSHLWAPI.DLLMD5=F9E249B6BB80C06BA30A61854567796C,SHA256=E5F62CD5D2FE7BE8D4E029ECA004A8773FF8D1F7AB92C115810AD54B5B8F50CA,IMPHASH=9F3DE8492A7F075320A36332ACC9CAAFtrueMicrosoft WindowsValid 734700x8000000000000000244183Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.613{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000244182Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.613{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\powrprof.dll10.0.14393.0 (rs1_release.160715-1616)Power Profile Helper DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationPOWRPROF.DLLMD5=C55F634054E45C0DEE47C254AE009928,SHA256=76EB0FCA87C3AD5FA1C46EB0AF88CF85E172525029E33F5DFC5645EF2EE6F575,IMPHASH=CBD4A2FD581B65B4B1934DA291FA2B86trueMicrosoft WindowsValid 734700x8000000000000000244181Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.613{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\windows.storage.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft WinRT Storage APIMicrosoft® Windows® Operating SystemMicrosoft CorporationWindows.Storage.dllMD5=0B1961C1D14DD3DE4342B6E7BCE700BC,SHA256=AADDD62E881A6A91A67EA1263798F4608DCEA6F59AE43A076880B2A621E2ED63,IMPHASH=A03B8A6BEC68C432E677F3D5E1DA4FAFtrueMicrosoft WindowsValid 734700x8000000000000000244180Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.612{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\cfgmgr32.dll10.0.14393.0 (rs1_release.160715-1616)Configuration Manager DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationCFGMGR32.DLLMD5=77BF2979C1A08EBA43C24FE0B7E547BE,SHA256=071E00374806E043A2E78E88C7FDDCE8F5983DE665DF41F3B3210660BF2EF704,IMPHASH=1835EBC72F9ADB09C6FCFABC04AC9C89trueMicrosoft WindowsValid 734700x8000000000000000244179Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.612{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\shell32.dll10.0.14393.5006 (rs1_release.220301-1704)Windows Shell Common DllMicrosoft® Windows® Operating SystemMicrosoft CorporationSHELL32.DLLMD5=CC49EC90F89D864201C457C480E62211,SHA256=731D0F819FAFEA355604D22AE73208DC15D82CE44B6BD6DF7184185B88145300,IMPHASH=CE6A42C292DA87885FAB409381075FA7trueMicrosoft WindowsValid 10341000x8000000000000000244178Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.612{8D845A55-24BC-6260-EE02-000000004402}1725788C:\Windows\system32\conhost.exe{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244177Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.609{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\SHCore.dll10.0.14393.4169 (rs1_release.210107-1130)SHCOREMicrosoft® Windows® Operating SystemMicrosoft CorporationSHCORE.dllMD5=D287E1BC5A148E2BCB482DBD0E925738,SHA256=1C2428AD170165DD8DE960C835D9AAB5B268300A676FE935B177ED5D2607430D,IMPHASH=3C09BDCE2388320645D7656AE2AC744CtrueMicrosoft WindowsValid 734700x8000000000000000244176Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.609{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244175Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.609{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\propsys.dll7.0.14393.4169 (rs1_release.210107-1130)Microsoft Property SystemWindows® SearchMicrosoft Corporationpropsys.dllMD5=013D2BA96C261CDC62ECA7365E1C84D5,SHA256=26896478B6F1AF3756D5B1BB59BF2C6BE1C579B122CC882BAC35FEFB3EC3EE36,IMPHASH=FF25576501EAFD13671A6D5075C4513EtrueMicrosoft WindowsValid 734700x8000000000000000244174Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.609{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244173Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.608{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244172Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.608{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\imm32.dll10.0.14393.0 (rs1_release.160715-1616)Multi-User Windows IMM32 API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationimm32MD5=E1024CF2E35DD3467F52BC83F7FEDA3F,SHA256=59C87761AD509BD096C2F35257C2370FB94B95160CB63FB9E66DFD8210AB002A,IMPHASH=C852E8FD14D356C81F834E318EEAD7FAtrueMicrosoft WindowsValid 734700x8000000000000000244171Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.608{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244170Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.608{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244169Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.607{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244168Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.607{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244167Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.607{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244166Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.607{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244165Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.606{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244164Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.606{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244163Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.606{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\ConhostV2.dll10.0.14393.4886 (rs1_release.220104-1735)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=90A1061677CEBBF9FF41283BBDFD851C,SHA256=01448DC953A0E6B96CDACA05EDDFB2FF053DA488F258600745AAE4FE840B4682,IMPHASH=8186D8B119B7234AAF75B4C29E77630DtrueMicrosoft WindowsValid 734700x8000000000000000244162Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.605{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 10341000x8000000000000000244161Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.604{8D845A55-15B0-6260-4F00-000000004402}38202388C:\Windows\system32\csrss.exe{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cd4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5179f 734700x8000000000000000244160Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.604{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244159Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.603{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244158Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.603{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244157Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.603{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe10.0.14393.0 (rs1_release.160715-1616)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXEMD5=D752C96401E2540A443C599154FC6FA9,SHA256=046F7A1B4DE67562547ED9A180A72F481FC41E803DE49A96D7D7C731964D53A0,IMPHASH=2C980A4DA7C717CC670CB9E1D2C4D733trueMicrosoft WindowsValid 10341000x8000000000000000244156Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.602{8D845A55-159D-6260-1000-000000004402}3405556C:\Windows\System32\svchost.exe{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244155Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.601{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244154Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.601{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244153Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.600{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244152Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.600{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exeC:\Temp\OIK\Temporary0\PService_PPD.exe------failed: Invalid hash-- 10341000x8000000000000000244151Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.600{8D845A55-159D-6260-1000-000000004402}3405556C:\Windows\System32\svchost.exe{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244150Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.599{8D845A55-159D-6260-1000-000000004402}3401108C:\Windows\System32\svchost.exe{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\pcasvc.dll+52e4|c:\windows\system32\pcasvc.dll+58a9|c:\windows\system32\pcasvc.dll+5b49|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3530e|C:\Windows\System32\RPCRT4.dll+20c87|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244149Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.599{8D845A55-159D-6260-1000-000000004402}3401108C:\Windows\System32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1440C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3530e|C:\Windows\System32\RPCRT4.dll+20c87|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244148Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.599{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244147Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.599{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244146Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.599{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244145Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.598{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244144Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.598{8D845A55-15B0-6260-4F00-000000004402}38204036C:\Windows\system32\csrss.exe{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244143Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.598{8D845A55-15DF-6260-9400-000000004402}43245576C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+16e70b|C:\Windows\System32\windows.storage.dll+16e421|C:\Windows\System32\windows.storage.dll+16e06e|C:\Windows\System32\windows.storage.dll+16f310|C:\Windows\System32\windows.storage.dll+16ddbe|C:\Windows\System32\windows.storage.dll+fce7d|C:\Windows\System32\windows.storage.dll+fd5bc|C:\Windows\System32\windows.storage.dll+fc920|C:\Windows\System32\windows.storage.dll+1664ca|C:\Windows\System32\windows.storage.dll+166222|C:\Windows\System32\SHELL32.dll+9cf3d|C:\Windows\System32\SHELL32.dll+9bad6|C:\Windows\System32\SHELL32.dll+d9be1|C:\Windows\System32\SHELL32.dll+c0bbe|C:\Windows\System32\SHELL32.dll+18d1bc|C:\Windows\System32\SHELL32.dll+18cf13|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244142Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.598{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Exe"C:\OIK\Temporary0\PService_PPD.exe" C:\OIK\Temporary0\ATTACKRANGE\Administrator{8D845A55-15DE-6260-DFBE-070000000000}0x7bedf2HighMD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 11241100x8000000000000000244141Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.504{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244140Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:28.504{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19F54732BF775A53DDC5743126D7AA9C,SHA256=7A12E4763BC54BFA97E6796498652F0C1FC765544B5C2EDD64ABD681BF1560FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244269Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.890{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244268Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.889{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B4C75B2E636B0134B8746A852895BEF,SHA256=293907E80C65EB9B156E20BD75D517481C89386A7FE7EE3717B4E2890354DD49,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244267Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.889{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000244266Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.888{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=07E3DDDA4DB7B46CDCF26DE708F3C19B,SHA256=F5469514F47EFDEC59AD611C71F9DB889ED5DAF1AEB5641009F1CAAA61694C69,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000244265Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.664{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe 734700x8000000000000000244264Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.664{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000244263Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.662{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244262Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.661{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000244261Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.515{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244260Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.515{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244259Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.514{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244258Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.513{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244257Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.512{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244256Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.511{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244255Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.511{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244254Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.511{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244253Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.505{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.5006 (rs1_release.220301-1704)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=F0258C58C8DC45AF9B5AAF9BA49E0C53,SHA256=8E1EAA39742CC0E97D615229E9C13C8447B8D115B4678A1F03BE3E8E20345521,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x8000000000000000244252Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.504{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244251Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.504{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244250Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.504{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244249Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.503{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244248Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.503{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244247Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.503{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244246Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.503{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244245Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.503{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244244Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.503{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244243Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.503{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244242Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.503{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244241Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.503{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244240Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244239Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244238Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244237Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244236Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244235Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244234Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244233Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244232Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x8000000000000000244231Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244230Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.502{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244229Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.501{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x8000000000000000244228Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.501{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x8000000000000000244227Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.501{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x8000000000000000244226Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.501{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244225Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.501{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000244224Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.501{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244223Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.500{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244222Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.500{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x8000000000000000244221Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.499{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244220Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.499{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244219Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.498{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244218Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.498{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244217Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.498{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52trueSplunk, Inc.Valid 10341000x8000000000000000244216Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.497{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244215Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.497{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244214Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.497{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244213Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.497{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244212Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.497{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244211Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.497{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244210Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:29.496{8D845A55-24BD-6260-EF02-000000004402}2348C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000244385Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.999{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe 10341000x8000000000000000244384Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.997{8D845A55-24BE-6260-F102-000000004402}60486056C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244383Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.997{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244382Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.996{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000244381Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.856{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244380Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.856{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244379Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.855{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244378Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.854{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244377Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.853{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244376Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.853{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244375Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.852{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244374Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.852{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244373Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.852{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000244372Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.846{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244371Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.845{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244370Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.845{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244369Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.845{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244368Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.845{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244367Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.845{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244366Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.845{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244365Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.845{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244364Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.845{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244363Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.844{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244362Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.844{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244361Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.844{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244360Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.844{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000244359Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.844{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244358Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.844{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000244357Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.843{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244356Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.843{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244355Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.843{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244354Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.843{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244353Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.842{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244352Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.842{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244351Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.842{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244350Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.842{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244349Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.841{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244348Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.841{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244347Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.841{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244346Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.841{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x8000000000000000244345Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.840{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244344Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.840{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244343Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.839{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244342Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.839{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244341Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.839{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2trueSplunk, Inc.Valid 10341000x8000000000000000244340Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.838{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244339Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.838{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244338Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.838{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244337Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.838{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244336Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.838{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244335Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.838{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244334Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.837{8D845A55-24BE-6260-F102-000000004402}6048C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000244333Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.683{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244332Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.680{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7A1C6E98EEBC0C002F93D4612951424,SHA256=ED7161E9263C219840CCD04100E8A7320431F5B75C2794AA4EC6A15E68A19000,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244331Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.410{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244330Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.409{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D444113CCF9B59340DE6087D46DE68E0,SHA256=79234CF732B9492AA52C1662DA027E34A8AB8D304BC3CCA3B12F61B1A1B26C19,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000244329Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.353{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe 734700x8000000000000000244328Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.353{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000244327Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.351{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244326Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.351{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 10341000x8000000000000000244325Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.275{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244324Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.275{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244323Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.275{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244322Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.271{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244321Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.271{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244320Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.271{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244319Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.271{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244318Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.192{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244317Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.191{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244316Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.191{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244315Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.189{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244314Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.188{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244313Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.187{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244312Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.187{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244311Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.187{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244310Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.181{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244309Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.180{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244308Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.180{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244307Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.180{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244306Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.180{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244305Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.179{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244304Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.179{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244303Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.179{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244302Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.179{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244301Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.179{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244300Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244299Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244298Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244297Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000244296Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244295Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244294Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244293Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244292Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244291Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244290Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.178{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244289Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.177{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244288Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.177{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244287Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.177{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244286Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.177{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x8000000000000000244285Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.177{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244284Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.177{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244283Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.177{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000244282Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.176{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244281Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.176{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244280Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.176{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244279Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.175{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x8000000000000000244278Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.175{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244277Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.175{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02DtrueSplunk, Inc.Valid 10341000x8000000000000000244276Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.175{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244275Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.174{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244274Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.174{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244273Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.174{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244272Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.174{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244271Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.173{8D845A55-24BE-6260-F002-000000004402}2944C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000244270Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.047{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=2D0E0BFCFB2CFB9DD3DDB83BFB940BB0,SHA256=C31638282A1FDA1CAC820805D878E9FD9ED6F7E131913637088AA1238EF1FAFF,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000244441Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.877{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 734700x8000000000000000244440Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.876{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x8000000000000000244439Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.875{8D845A55-24BF-6260-F202-000000004402}44804332C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244438Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.875{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244437Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.875{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000244436Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.726{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244435Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.726{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244434Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.725{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244433Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.724{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244432Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.723{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244431Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.723{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244430Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.723{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244429Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.722{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244428Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.716{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244427Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.716{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244426Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.716{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244425Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.715{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244424Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.715{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244423Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.715{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244422Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.715{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244421Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.715{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244420Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.714{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244419Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.714{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244418Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.714{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244417Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.714{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244416Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.714{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244415Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.714{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000244414Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.714{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244413Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.714{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244412Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.714{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244411Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.713{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244410Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.713{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244409Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.713{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244408Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.713{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244407Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.713{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244406Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.713{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244405Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.713{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244404Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.713{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244403Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.713{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244402Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.712{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000244401Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.712{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244400Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.711{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244399Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.711{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244398Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.710{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244397Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.710{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9trueSplunk, Inc.Valid 10341000x8000000000000000244396Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.710{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244395Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.710{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244394Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.709{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244393Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.709{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244392Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.709{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244391Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.709{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244390Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.709{8D845A55-24BF-6260-F202-000000004402}4480C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000244389Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.708{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244388Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:31.707{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3238BEDE38B39738A74F5D31A389E9C2,SHA256=03DF867811EDB0EB6DD2A22BFB5C6D577152ADB9FDEDFA4F8C6B80808965235A,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244387Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.728{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56237-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000244386Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:27.728{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56237-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 11241100x8000000000000000244497Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.749{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244496Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.748{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2211FB30A829EBB8D99B26C0E98EBE2C,SHA256=22E0BD5BA46D74FF32F994F178F430435D3BE61868E322F18228CF8875BDE064,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244495Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.728{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244494Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.728{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F43CAFACEA57E22952B5442093DD311A,SHA256=0E95A14BB25AFF39A70C6B44003C602D2B989D714B81A3C12A66FE692C861399,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000244493Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.518{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 734700x8000000000000000244492Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.517{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x8000000000000000244491Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.516{8D845A55-24C0-6260-F302-000000004402}46644948C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244490Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.516{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244489Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.515{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000244488Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.356{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244487Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.356{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244486Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.355{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244485Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.355{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244484Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.353{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244483Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.352{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244482Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.352{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244481Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.352{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244480Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.343{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244479Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.342{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244478Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.342{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244477Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.342{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244476Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.342{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244475Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.341{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244474Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.341{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244473Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.341{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244472Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.341{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244471Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.341{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244470Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.341{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244469Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.341{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244468Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.340{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000244467Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.340{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244466Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.340{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244465Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.340{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244464Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.340{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244463Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.340{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244462Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.340{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244461Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.340{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244460Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.340{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244459Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.339{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244458Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.339{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244457Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.339{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244456Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.339{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244455Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.339{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244454Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.339{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000244453Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.338{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244452Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.337{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244451Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.337{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244450Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.337{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244449Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.336{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9trueSplunk, Inc.Valid 10341000x8000000000000000244448Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.336{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244447Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.335{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244446Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.335{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244445Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.335{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244444Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.335{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244443Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.335{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244442Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:32.334{8D845A55-24C0-6260-F302-000000004402}4664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000244612Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.864{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244611Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.864{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7CEAA8B4CDD6241A7C32CC81E2ECE4F,SHA256=EC5E05991DE9D5440451AA8225907931409E6EB6B98DAA19EF5FB56C0E76D194,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244610Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.861{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244609Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.861{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A54959123FACBA0247EB8A0D1F19334A,SHA256=C3042BC6AD07B9B5A86F5540009310C4A3F8D0BD785A92F52078E79E64AFFD95,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000244608Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.842{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe 734700x8000000000000000244607Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.841{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000244606Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.839{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244605Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.839{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000244604Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.684{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244603Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.684{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244602Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.684{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244601Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.683{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244600Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.681{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244599Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.681{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244598Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.681{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244597Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.674{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244596Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.674{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244595Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.674{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244594Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.673{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244593Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.673{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244592Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.673{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244591Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.673{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4704 (rs1_release.211004-1917)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=FBB483E6A34C0E6772984FD93573CB4A,SHA256=170792721871CF37C76CD2F662DFE92568E2EBDC45075B974D2125249BB6398D,IMPHASH=396555AAEAB1402915E17EE8C257B7CFtrueMicrosoft WindowsValid 734700x8000000000000000244590Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.673{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244589Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.673{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244588Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.673{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244587Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244586Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244585Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244584Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244583Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244582Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244581Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244580Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244579Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244578Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.672{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244577Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.671{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000244576Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.671{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244575Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.671{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244574Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.671{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244573Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.670{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000244572Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.670{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244571Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.670{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244570Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.669{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244569Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.669{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x8000000000000000244568Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.669{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244567Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.668{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244566Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.667{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244565Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.667{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244564Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.667{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9trueSplunk, Inc.Valid 10341000x8000000000000000244563Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.666{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244562Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.666{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244561Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.666{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244560Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.666{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244559Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.666{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244558Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.665{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244557Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.666{8D845A55-24C1-6260-F502-000000004402}3416C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000244556Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.623{8D845A55-15DF-6260-9400-000000004402}43242492C:\Windows\Explorer.EXE{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+6497|C:\Windows\System32\SHCORE.dll+6387|C:\Windows\System32\SHCORE.dll+62fd|C:\Windows\System32\SHCORE.dll+620a|C:\Windows\System32\SHELL32.dll+af4a0|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9824|UNKNOWN(FFFFF800B9E62B58)|UNKNOWN(FFFFFDB12ECA5B88)|UNKNOWN(FFFFFDB12ECA5D07)|UNKNOWN(FFFFFDB12ECA0391)|UNKNOWN(FFFFFDB12ECA1D5A)|UNKNOWN(FFFFFDB12ECA0016)|UNKNOWN(FFFFF800B9B78503)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+b2cfb|C:\Windows\System32\SHELL32.dll+5360a|C:\Windows\System32\SHCORE.dll+33fad 10341000x8000000000000000244555Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.623{8D845A55-15DF-6260-9400-000000004402}43242492C:\Windows\Explorer.EXE{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exe0x40C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHCORE.dll+64c8|C:\Windows\System32\SHCORE.dll+1c0e5|C:\Windows\System32\SHELL32.dll+aef81|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11ed7|C:\Windows\System32\USER32.dll+22a53|C:\Windows\SYSTEM32\ntdll.dll+a9824|UNKNOWN(FFFFF800B9E62B58)|UNKNOWN(FFFFFDB12ECA5B88)|UNKNOWN(FFFFFDB12ECA5D07)|UNKNOWN(FFFFFDB12ECA0391)|UNKNOWN(FFFFFDB12ECA1D5A)|UNKNOWN(FFFFFDB12ECA0016)|UNKNOWN(FFFFF800B9B78503)|C:\Windows\System32\win32u.dll+10c4|C:\Windows\System32\USER32.dll+1ea2e|C:\Windows\System32\SHELL32.dll+b2cfb|C:\Windows\System32\SHELL32.dll+5360a|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 23542300x8000000000000000244554Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.623{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF3b3f0d.TMPMD5=DD8C29AAE0A45C3822ADE0E7CA84C037,SHA256=448C743772008F1A6623E6915E6111011845DFE3385A89996681D81E97DA526D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244553Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.622{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RF3b3f0d.TMP2022-04-20 15:20:33.621 11241100x8000000000000000244552Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.618{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q6CV8RKQWR8HRIJRZEWR.temp2022-04-20 15:20:33.617 354300x8000000000000000244551Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:30.516{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56238-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 534500x8000000000000000244550Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.181{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe 734700x8000000000000000244549Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.180{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x8000000000000000244548Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.178{8D845A55-24C1-6260-F402-000000004402}55362144C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+610325|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60fe56|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60943|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+9e7f20|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244547Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.172{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244546Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.172{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000244545Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.018{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244544Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.018{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244543Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.017{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244542Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.017{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244541Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.015{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244540Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.015{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244539Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.014{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244538Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.014{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244537Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.008{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244536Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.008{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244535Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.007{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244534Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.007{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244533Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.007{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244532Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.007{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244531Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.007{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244530Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.006{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244529Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.006{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244528Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.006{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244527Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.006{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244526Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.006{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244525Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.006{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244524Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.006{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000244523Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.005{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244522Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.005{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244521Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.005{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244520Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.005{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244519Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.005{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244518Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.005{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244517Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.005{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244516Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.005{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244515Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.005{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244514Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.004{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244513Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.004{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244512Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.004{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244511Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.004{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x8000000000000000244510Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.004{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000244509Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.003{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244508Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.003{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244507Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.002{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244506Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.002{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244505Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.002{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778trueSplunk, Inc.Valid 10341000x8000000000000000244504Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.002{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244503Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.001{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244502Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.001{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244501Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.001{8D845A55-159C-6260-0C00-000000004402}844100C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244500Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.001{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244499Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.001{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244498Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:33.000{8D845A55-24C1-6260-F402-000000004402}5536C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000244614Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:34.868{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244613Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:34.867{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12953B2B400EACBAC224D2BC6786D5FB,SHA256=A934DAF8FDEC54AA51A63E27DCA2BB3B5166D86739D8A7A41BD515F7B8404411,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244623Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.973{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244622Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.972{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E43A68C13D391B185F225E8A6EEF9A24,SHA256=C16C50706C1203EEE9443B791210A5C46630C744BB87AB8451828596459BA301,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000244621Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.561{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244620Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.560{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244619Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.560{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244618Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.553{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244617Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.553{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244616Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.553{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244615Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.553{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000244625Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:37.082{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244624Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:37.082{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B8C529B4877F3D43E1CBDF8634DAA77,SHA256=660BC0DCD14BD250064125FA9FE6F7E83706AB23C2EA05FA95DC5ABF6B35934E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000244635Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:38.742{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244634Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:38.741{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244633Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:38.741{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244632Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:38.738{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244631Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:38.738{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244630Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:38.737{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244629Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:38.737{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 354300x8000000000000000244628Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:35.568{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56239-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244627Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:38.186{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244626Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:38.185{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68D84D149E28D2EAC136CCD3D566B731,SHA256=B1F775CD8207BB52EDE1D94C5D67697C1A4ED86DE35A5AE0C9C0A7FF1FB94E03,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244637Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:39.292{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244636Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:39.292{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E89FC2DFD0C128BADACFA2ECD97C02FC,SHA256=FD80B1D9089AD3F6203FA06D341E05059D4AD652598589585587E2B550695AAC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244639Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:40.299{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244638Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:40.299{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB4313B67F3AF23B6AD90D23611937E5,SHA256=C5AF9E03E989089144AD7E49A6D2464854A96D90EA576EC4DE4E90BF04D2B359,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000244648Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:41.973{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bbfd5|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244647Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:41.972{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bbeee|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244646Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:41.972{8D845A55-15DF-6260-9400-000000004402}43242468C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0E02-000000004402}5068C:\Windows\system32\cmd.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bbeb7|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13be8f|C:\Windows\System32\windows.storage.dll+13ac1b|C:\Windows\System32\windows.storage.dll+13913f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39d09|C:\Windows\SYSTEM32\ntdll.dll+1e89a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244645Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:41.969{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb0af|C:\Windows\System32\SHELL32.dll+bc660|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244644Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:41.969{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+10ac30|C:\Windows\System32\SHELL32.dll+bc61c|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244643Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:41.969{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+bb304|C:\Windows\System32\SHELL32.dll+bc5f0|C:\Windows\System32\TwinUI.dll+100981|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244642Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:41.969{8D845A55-15DF-6260-9400-000000004402}4324372C:\Windows\Explorer.EXE{8D845A55-1E5C-6260-0F02-000000004402}3144C:\Windows\system32\conhost.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+1007b9|C:\Windows\System32\TwinUI.dll+1011ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000244641Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:41.403{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244640Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:41.403{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=724BBBB69D7D1FBCE6298F4547FCAA09,SHA256=F559DF6C7C87FE66605665912208F2BA9DA40FA52351F116C2C670AA5CD52488,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244650Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:42.511{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244649Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:42.510{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E922455A6A29B7477436AE8CF3AA973,SHA256=FE6763E3D24EC44C546BD985A81DB049344508BE0ED5B7FC88CD4C18BE0C5C6B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244653Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:43.615{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244652Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:43.615{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C17AE1AD4081C32FA4EAC915596B094,SHA256=CCD3B3DC475E163F9BCCED23302189E9C319547C447853B990A5D091F8D1CD06,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244651Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:40.609{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56240-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244655Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:44.720{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244654Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:44.719{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC87C041ACCA57DA1559F383C12C7D7B,SHA256=BBB1DDCC6FB9E12F757DFDE2C779DE244D09DDAA388FD6CD4CDD6D4D37430D25,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244657Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:45.824{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244656Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:45.823{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=210038CBD44F4AE2C2504FEE3C4A1642,SHA256=40C3ED7152E8119EA447DB06C864AD29A3D83301FA1689CCD7B29C1AF1DD5F74,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244659Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:46.827{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244658Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:46.827{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E064E9239B70B39687C686D87ECA306,SHA256=9364BDC447E7251B74CD97CB198458FBDE77828FC9CF7E2DBBDBC8D94F98D14E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244663Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:47.936{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244662Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:47.936{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3D4D27B71AC28EB652B72D84C27F969,SHA256=21857976606FA7B8CC19D6E98F0A18461590B76129EBC381549B53DF565162C3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244661Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:47.785{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000244660Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:47.785{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=25405A84500A55ECF2D83037732A33C7,SHA256=115C909006367D0717FA8FF5244E81E80401F42AE3222D0BF73BC19759360529,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244664Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:45.632{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56241-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244666Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:49.040{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244665Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:49.040{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D6B417071465F4F6093DF9A46032456E,SHA256=C27AD7977D7A6409FF1B2AEE0CE1CCA44CA76A0FD10034806C446BC80BD441F1,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244668Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:50.147{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244667Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:50.146{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D447BC63605E21F4C51CDA2B2789CD96,SHA256=68CD360A0610DC44CBD7C15775A3C6CFE041667FD27F44F9065A2E1250C336E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000244673Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:51.959{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\respondent-20220420141616-062MD5=8D93873C901538A8B2B909297EDAE7BB,SHA256=9423023AAA5D37B26F7EE3576993D2852CE2F95EF8E5E497C042A8474DDD26FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244672Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:51.957{8D845A55-15B0-6260-4700-000000004402}3580C:\Program Files\Amazon\SSM\ssm-agent-worker.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\respondent-20220420141616-0622022-04-20 15:20:51.957 11241100x8000000000000000244671Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:51.956{8D845A55-15AE-6260-2D00-000000004402}2972C:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\surveyor-20220420141614-0632022-04-20 15:20:51.956 11241100x8000000000000000244670Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:51.254{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244669Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:51.254{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2CF240CB06F9CC4CF382E1DE84F1E853,SHA256=E463F8AB0C6C3A49A3335A10DB6751431072B63A8AAC583A03E54E2491C983D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000244676Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:52.962{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\surveyor-20220420141614-063MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244675Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:52.360{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244674Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:52.359{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=95AE580924588F064E2E7006670819A2,SHA256=B36AD915780BC33BE29CEE13153EFCF16F166F4B2A6EB43B5ECFA0CBF1FFB1E2,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244679Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:50.656{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56242-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244678Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:53.466{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244677Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:53.465{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=385DD783637FB06A180E00276853905C,SHA256=1EFDA59B8AB9F456EFCF589F3D84133C44BDB15B4693D8D7F423B07D365E6CEE,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244681Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:54.569{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244680Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:54.569{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDDED5FC6B78AF01814414784BD52E8C,SHA256=6400CF22D9E5034AD56031E437A9E0544B33C812D0ECBE394AEE3E68236AF17C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244683Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:55.674{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244682Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:55.674{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BC0264D7F03CD22C19D27E6EC36AD3B,SHA256=931DD048143907131A57EEB94EB8419063DA5A354461A37F931F895A9095CA4F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244686Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:56.681{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244685Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:56.680{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AD53419BB81FC30BC9E799BAEE8D7C8,SHA256=548E4D3D6C7E92AD2AC1C224EFE3E716E47119843B00CAA94F65987625126C04,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244684Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:56.086{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:20:56.086 11241100x8000000000000000244688Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:57.686{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244687Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:57.685{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7EF66E998C698DDD4BDBF8378847B1DD,SHA256=012B33BBE9A3EDEE2CB2F119A6CB0C376BF08205C9D4FACA6B3279F85B1AF754,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244690Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:58.692{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244689Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:58.692{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F6A6C9645BB4C485683485C22A9D780,SHA256=FE9A4CC191A65DA263FB008D7CE4618D21C0214518DEEA12220616737F2A3071,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244695Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:59.699{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244694Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:59.699{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C9FBF4C54E57A942D33274A843F6BA1,SHA256=847836471186007AAC054AF84D1F67A42DEED9307A8B224F3300BCC28EABD947,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244693Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:59.277{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat2022-04-20 14:16:57.501 23542300x8000000000000000244692Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:59.277{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=EA5F46ACEC57E236F3451FFB9C5374BE,SHA256=86AA29A3ADCB985922C164174651B9AC980F26678E3931344DFAFA226499FFE3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000244691Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:59.264{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=63E14849F352D02C6B2D3056E39F78FD,SHA256=C14ED6E0C6082E63EAD911D929B4FEE55475E41EE1CE476BDE12538F9DE30445,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244705Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:00.804{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244704Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:00.804{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=49D783A630337C641B57F7F675651121,SHA256=125CDC88D9CCC6521DA2DB50AD6023A7D11E5D7D464C90D04C863D633A5802C3,IMPHASH=00000000000000000000000000000000falsetrue 734700x8000000000000000244703Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:00.572{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exeC:\Windows\SysWOW64\mswsock.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft Windows Sockets 2.0 Service ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationmswsock.dllMD5=F18662FD1BCB04019CA35313C7BD1AB0,SHA256=44968455D3EEA914958BF90A83BA9311E9311676C32D8D46BB6109DF655738A4,IMPHASH=3BCAD7DA03A0242A2A34491F77EA8067trueMicrosoft WindowsValid 534500x8000000000000000244702Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:00.534{8D845A55-24BC-6260-EE02-000000004402}172C:\Windows\System32\conhost.exe 534500x8000000000000000244701Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:00.532{8D845A55-24B5-6260-EC02-000000004402}5960C:\Windows\System32\conhost.exe 534500x8000000000000000244700Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:00.531{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe 10341000x8000000000000000244699Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:00.530{8D845A55-24A2-6260-EA02-000000004402}44042704C:\OIK\Temporary0\industroyer2.exe{8D845A55-24BC-6260-ED02-000000004402}4104C:\OIK\Temporary0\PService_PPD.exe0x1C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e57|C:\Windows\SYSTEM32\ntdll.dll+78145|C:\Windows\SYSTEM32\ntdll.dll+77fae|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c6ae8(wow64)|C:\OIK\Temporary0\industroyer2.exe+774d|C:\OIK\Temporary0\industroyer2.exe+4f9b|C:\OIK\Temporary0\industroyer2.exe+513a|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 534500x8000000000000000244698Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:00.528{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe 10341000x8000000000000000244697Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:00.528{8D845A55-24A2-6260-EA02-000000004402}44042704C:\OIK\Temporary0\industroyer2.exe{8D845A55-24B5-6260-EB02-000000004402}5824C:\OIK\Temporary0\PServiceControl.exe0x1C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e57|C:\Windows\SYSTEM32\ntdll.dll+78145|C:\Windows\SYSTEM32\ntdll.dll+77fae|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c6ae8(wow64)|C:\OIK\Temporary0\industroyer2.exe+774d|C:\OIK\Temporary0\industroyer2.exe+4f9b|C:\OIK\Temporary0\industroyer2.exe+513a|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 354300x8000000000000000244696Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:20:56.512{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56243-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244707Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:01.911{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244706Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:01.911{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=983020ED285EB8F348797F558658C43F,SHA256=F415B0C9193FE7FF8933CDECE20151C87A4A1DC6FE78844A2FBC73DBF6BBFF73,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000244709Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.localInvDBSetValue2022-04-20 15:21:02.532{8D845A55-159D-6260-1000-000000004402}340C:\Windows\System32\svchost.exeHKU\S-1-5-21-3969656166-2769217111-789616835-500\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\OIK\Temporary0\PService_PPD.exeBinary Data 13241300x8000000000000000244708Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.localInvDBSetValue2022-04-20 15:21:02.529{8D845A55-159D-6260-1000-000000004402}340C:\Windows\System32\svchost.exeHKU\S-1-5-21-3969656166-2769217111-789616835-500\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\OIK\Temporary0\PServiceControl.exeBinary Data 11241100x8000000000000000244713Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:03.360{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000244712Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:03.360{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244711Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:03.016{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244710Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:03.016{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F2D36FC73E4B0853E17BF7382698331,SHA256=50308E66203E9E7EAF5A403E224ECB42144C0D301E00B70872D7C0F228186E05,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244715Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:04.120{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244714Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:04.119{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF6E5581402B449B4251A9159C56150F,SHA256=428464721B86606B02C95D75F29FA3E1E7596F3987794A06AF5D4326A2D5A0B0,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244719Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:01.767{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56248-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8089- 354300x8000000000000000244718Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:01.640{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56247-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244717Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:05.224{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244716Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:05.223{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C9D82BFA7A451633C74C6D5AFC91B109,SHA256=4CDA7D9FB9DBA375C70823805756D4E70F560B178AC69C01938BE14FD5B2DDC5,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244721Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:06.328{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244720Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:06.328{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7CEDCCD0A60BAFB05F85BFF6AE7BA8D,SHA256=A50A12FBFFFF7B4DD7910862450F63868EE8CE81A486D75292502A2656520C9C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244723Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:07.431{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244722Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:07.431{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B4CAE9F843D2BC76F6BCC45C6945AFA,SHA256=0685798078C1963255C7BB3EF2B7960E3729A96A51A345CBE7F3F3FF3FEBA43A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244725Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:08.535{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244724Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:08.535{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=15D777BBB89325AA203E8B9E079566D9,SHA256=AC74CEB862F80998F488317A2250762C7788FCD437F0CE9FAE2A279850F2F985,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244727Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:09.638{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244726Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:09.637{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2EE5B781BCD36273842DDD2BA9B16D4,SHA256=FAB97E2806B9C625224BF783983008172C0A441D234BF415EC96FFCF03B5B561,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244729Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:10.641{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244728Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:10.641{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CE5A9597479B6863CC5EE28E027F936,SHA256=925BCD2A5C354278923E2B65564D80337C86BBC4AFE39B08D4E4F0B95A234580,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000244733Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:21:11.882{8D845A55-159D-6260-1200-000000004402}504C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d854ca-0x449ee8b6) 11241100x8000000000000000244732Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:11.745{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244731Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:11.745{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F262C6580639198987340205C175BF24,SHA256=BE3727ECF84E887B1B09CEFDA955DB89ACECE61E583BAEC9A1CBF28562BB46D7,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244730Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:07.599{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56249-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244735Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:12.850{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244734Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:12.849{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B5BC73D74461B91890CD284F825857E7,SHA256=9DE2659218D43C34328218FC9FF493B2EB78EF5C4A73AE4071AFDDBCC0813687,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244738Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:13.952{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244737Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:13.952{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=944603ADC7EC712F3B7F7DFA2F07628F,SHA256=1A195C92F0C9AAF496F8B90DDA83C6BF1C1C6BA31C7E18105BD6C9E5D3E14736,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244736Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:10.268{8D845A55-159D-6260-1200-000000004402}504C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local123ntpfalse168.61.215.74-123ntp 534500x8000000000000000244741Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:15.637{8D845A55-24A2-6260-EA02-000000004402}4404C:\OIK\Temporary0\industroyer2.exe 11241100x8000000000000000244740Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:15.057{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244739Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:15.056{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB7A6E2B6E38C3CF54B0E18E4C40E485,SHA256=BA17716BB5E1E9E58AA927511BF0C05938C45D53619AFDEBD56862884FA0B3F5,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244744Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:13.584{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56250-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244743Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:16.060{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244742Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:16.060{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EA047C0872F18B50326735D48180580,SHA256=CE3EC6823E4A6417F009ABDE281F5B42B4EDBDFD95CD016F445AE0063DC28C35,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244746Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:17.065{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244745Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:17.065{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DEC81EC5CBF78E7E78106DF787140295,SHA256=FA799E20A2998FA2E6A02522E9F52BA90F2E8B1040DC106C755CFCE1361F369A,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244748Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:18.168{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244747Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:18.168{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDE225473C44952AD06AE9DE85B98B53,SHA256=ACA8653FF9C490AB27EF70806007B3F7D0A751433D43873E0719ED6C38FB706F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244750Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:19.275{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244749Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:19.274{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0C1E7063872D1C89001034FEAE68CF0,SHA256=108EE929AEC83190E50F4F275649AA610718A92AD9712200BFEACD3361494594,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244752Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:20.278{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244751Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:20.278{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC888A8F8FFA96A5650256A6CA79C2F3,SHA256=0DE331CA714EA660FB25C04906FAD75F498F9E7F753F2651033757AAA280E52F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244754Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:21.282{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244753Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:21.281{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B1F873213E3A95A18B86D9ED9470655,SHA256=F7E050E260A2733CC1AA5F2407948333518CCECB6E0A3FCA3585D0AEECDD8FAA,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244757Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:19.523{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56251-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244756Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:22.386{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244755Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:22.385{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=09EE75CFAF668F43EE1180C82657BE6D,SHA256=A1EA9398D204752F174E7BB75ADBB4FC8D394D9BC6D8CCB0C0D58DB68C037BE0,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244759Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:23.489{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244758Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:23.489{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=912B66DB9C583F294B9E6259CADBAD2B,SHA256=7F761BB230D54F794DF2E87EEACBB07C663552BA8068FDE13FC168ABC09379C2,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244761Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:24.592{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244760Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:24.591{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=864F8C8D3C260391F467E743327F662E,SHA256=8A6EFF706E4B310AB066D589FF53C5B55BE41DEC43308CEF9B7C7AD03C7C5966,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244763Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:25.604{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244762Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:25.604{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=878C0C524E51FDC8EA064AAB0D2038E7,SHA256=72AA2841E9CECD84D83E5E09C2591FE9BBACE07999C621DB4F501552BDB679EB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244766Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:26.707{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244765Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:26.707{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AC16B9776C5A64BE79564A49EC64DD6,SHA256=189BA77546BF9F024B3524BA30B5171EE4A764E6FE25B266D1DACF2E087EC7E6,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244764Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:26.098{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:21:26.098 11241100x8000000000000000244768Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:27.810{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244767Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:27.810{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1AF2E48CA248DD9A3CF52C0E98857E8D,SHA256=8396F6229215530DB67F576E1CE9DA3671D9209D3D3C5209256A729DAA0B3915,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000244771Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:28.916{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244770Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:28.915{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D2CFDA37254B32C42D01B285C05B7E1,SHA256=509D763B2364FE18426DA1DCCD8CDF9121AC8004A27642E2633DF43DC83DED7B,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000244769Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:24.638{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56252-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000244830Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.885{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000244829Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.885{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=4F0854CA83D5ED7E2DF48629E4199C83,SHA256=19498585EAEF70262CABE178C27970A25C02CDCEE452C88E7AC54A20681467B3,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000244828Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.683{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe 734700x8000000000000000244827Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.682{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000244826Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.680{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244825Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.679{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000244824Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.526{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244823Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.525{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244822Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.525{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244821Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.524{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244820Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.523{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244819Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.522{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244818Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.522{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244817Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.522{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244816Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.515{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.5006 (rs1_release.220301-1704)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=F0258C58C8DC45AF9B5AAF9BA49E0C53,SHA256=8E1EAA39742CC0E97D615229E9C13C8447B8D115B4678A1F03BE3E8E20345521,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x8000000000000000244815Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.513{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244814Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.512{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244813Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.512{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244812Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.512{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244811Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.512{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244810Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.512{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244809Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.512{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244808Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.511{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244807Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.511{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244806Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.511{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244805Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.511{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244804Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.511{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244803Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.511{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244802Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.511{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244801Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.511{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244800Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.511{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244799Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244798Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244797Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244796Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x8000000000000000244795Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244794Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244793Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244792Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x8000000000000000244791Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x8000000000000000244790Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.510{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x8000000000000000244789Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.509{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244788Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.508{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000244787Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.508{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244786Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.508{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244785Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.508{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x8000000000000000244784Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.507{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244783Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.506{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244782Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.506{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244781Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.506{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244780Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.506{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52trueSplunk, Inc.Valid 10341000x8000000000000000244779Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.506{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244778Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.505{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244777Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.505{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244776Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.505{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244775Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.505{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244774Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.505{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244773Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.504{8D845A55-24F9-6260-F602-000000004402}3376C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000244772Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:29.481{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=E83F817C256C95D5104818331E52706C,SHA256=672761DE506181E8AEFFB9D2F1B502C4A4DD567050989968E3EF66A18621B4C4,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000244942Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.758{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe 10341000x8000000000000000244941Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.756{8D845A55-24FA-6260-F802-000000004402}16244948C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244940Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.756{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244939Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.755{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 11241100x8000000000000000244938Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.726{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244937Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.725{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=36A341FD48651DD0C1D8CF82F586205B,SHA256=7FFA91D9E5335769DCDA59B26E1A4205962E5C84DBE4AA5153DD6E615CAB2FEA,IMPHASH=00000000000000000000000000000000falsetrue 734700x8000000000000000244936Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.609{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244935Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.609{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244934Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.608{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244933Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.608{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244932Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.606{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244931Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.605{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244930Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.605{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244929Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.605{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244928Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.604{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000244927Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.598{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244926Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.598{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244925Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.598{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244924Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.598{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244923Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.598{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244922Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.598{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244921Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.597{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244920Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.597{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244919Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.597{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244918Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.597{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244917Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.597{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244916Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.597{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244915Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.597{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000244914Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.595{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244913Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.595{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000244912Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.595{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244911Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.595{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244910Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.595{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244909Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.595{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244908Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.595{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244907Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.595{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244906Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.595{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244905Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.593{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244904Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.593{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244903Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.593{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244902Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.593{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244901Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.593{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x8000000000000000244900Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.591{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244899Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.591{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244898Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.591{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 10341000x8000000000000000244897Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.590{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244896Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.590{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244895Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.590{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 10341000x8000000000000000244894Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.590{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244893Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.590{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2trueSplunk, Inc.Valid 10341000x8000000000000000244892Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.589{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244891Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.588{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244890Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.588{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244889Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.588{8D845A55-24FA-6260-F802-000000004402}1624C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x8000000000000000244888Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:27.729{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56253-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000244887Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:27.729{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56253-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 11241100x8000000000000000244886Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.339{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000244885Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.339{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=491F0621BB4BAE633CD795075829E0F6,SHA256=B8315F4C7BEB70FCA83FC2C478EA5D28E12FEA8410C5DEEB850B2FC6C3AE6BAC,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000244884Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.234{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe 734700x8000000000000000244883Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.233{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000244882Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.232{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244881Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.231{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000244880Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.092{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244879Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.092{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244878Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.092{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244877Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.090{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244876Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.089{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244875Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.088{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244874Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.088{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244873Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.087{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244872Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.081{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244871Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.080{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244870Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.077{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244869Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.077{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244868Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.077{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244867Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.077{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244866Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.077{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244865Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.076{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244864Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.076{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244863Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.076{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244862Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.076{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244861Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.076{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244860Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.076{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244859Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.076{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244858Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.076{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000244857Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.076{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244856Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.075{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244855Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.075{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244854Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.075{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244853Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.075{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244852Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.074{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244851Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.073{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244850Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.073{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244849Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.073{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244848Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.073{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244847Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.073{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244846Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.073{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x8000000000000000244845Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.073{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000244844Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.072{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244843Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.071{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244842Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.071{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244841Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.071{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244840Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.071{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02DtrueSplunk, Inc.Valid 10341000x8000000000000000244839Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.070{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244838Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.070{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244837Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.070{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244836Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.070{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244835Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.070{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244834Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.069{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244833Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.070{8D845A55-24FA-6260-F702-000000004402}2380C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000244832Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.069{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244831Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.069{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B7D5E5A5B535D978D5A6B2F61D597020,SHA256=30683EE5D4FA0CE88647DB7B798D983CEB93A0576D75EE6791DF467A45D626D2,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000244996Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.879{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 734700x8000000000000000244995Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.877{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x8000000000000000244994Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.877{8D845A55-24FB-6260-F902-000000004402}21444880C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244993Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.877{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000244992Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.876{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000244991Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.733{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000244990Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.732{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000244989Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.732{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000244988Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.731{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000244987Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.729{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000244986Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.729{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000244985Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.729{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000244984Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.728{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000244983Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.722{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000244982Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.722{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000244981Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.722{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000244980Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.721{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000244979Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.721{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000244978Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.721{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000244977Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.720{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000244976Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.720{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000244975Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.720{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000244974Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.720{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000244973Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.720{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244972Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.720{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000244971Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.720{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000244970Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000244969Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000244968Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000244967Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000244966Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000244965Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000244964Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000244963Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000244962Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000244961Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000244960Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000244959Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.719{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000244958Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.718{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000244957Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.718{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000244956Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.717{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000244955Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.717{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000244954Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.716{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000244953Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.716{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000244952Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.716{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9trueSplunk, Inc.Valid 10341000x8000000000000000244951Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.715{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244950Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.715{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244949Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.715{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244948Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.715{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244947Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.715{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244946Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.715{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244945Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.715{8D845A55-24FB-6260-F902-000000004402}2144C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000244944Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.245{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000244943Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:31.244{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=49FDE5AA0AEDD907BC28B8101ABCF11E,SHA256=F64BBCD567DFCA6A443FAFC8A9B0F9B9D973C0F57137884BAD6A96E2CA70DB79,IMPHASH=00000000000000000000000000000000falsetrue 734700x8000000000000000245098Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.928{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000245097Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.927{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000245096Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.927{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000245095Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.926{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000245094Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.925{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000245093Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.924{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000245092Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.924{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000245091Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.924{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000245090Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.918{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000245089Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.918{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000245088Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.917{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000245087Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.917{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000245086Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.917{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000245085Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.917{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000245084Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.917{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000245083Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.917{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000245082Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.916{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000245081Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.916{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245080Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.916{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000245079Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.916{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000245078Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.916{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000245077Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.916{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000245076Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.916{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000245075Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.916{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000245074Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.916{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000245073Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.915{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000245072Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.915{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000245071Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.915{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000245070Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.915{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000245069Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.915{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000245068Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.915{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000245067Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.915{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000245066Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.915{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000245065Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.915{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000245064Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.914{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x8000000000000000245063Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.914{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000245062Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.913{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245061Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.913{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000245060Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.913{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000245059Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.912{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245058Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.912{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exeMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778trueSplunk, Inc.Valid 10341000x8000000000000000245057Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.912{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245056Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.912{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245055Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.912{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245054Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.911{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245053Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.911{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000245052Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.911{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000245051Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.910{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.2.5Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=C8BED8D054FDE4C4222F39C750539874,SHA256=765D1E768D7027343C681DF3B2F6113ED0337F7179CDAE9CF89979A8725CE490,IMPHASH=5DCBAD7446F97D73DA1DA121D8CD8778{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000245050Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.777{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245049Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.776{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3DFA6B9C684B0E4B94531A19B365676C,SHA256=21BA28BEB1E29A21F1C9C06FB5BC2069D085D1264C30107C311DEAC810950696,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000245048Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.553{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 734700x8000000000000000245047Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.552{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x8000000000000000245046Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.551{8D845A55-24FC-6260-FA02-000000004402}53444440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245045Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.551{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000245044Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.550{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000245043Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.399{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000245042Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.399{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000245041Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.398{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000245040Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.397{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000245039Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.396{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000245038Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.396{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000245037Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.395{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000245036Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.395{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000245035Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.388{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000245034Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.387{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000245033Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.387{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000245032Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.387{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000245031Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.387{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000245030Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.386{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000245029Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.386{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000245028Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.386{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000245027Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.386{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245026Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.386{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000245025Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.386{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000245024Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.386{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000245023Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.386{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000245022Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.385{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000245021Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.385{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000245020Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.385{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000245019Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.385{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000245018Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.385{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000245017Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.385{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000245016Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.385{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000245015Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.385{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000245014Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.385{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000245013Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.384{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000245012Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.384{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000245011Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.384{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000245010Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.384{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000245009Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.384{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000245008Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.383{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245007Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.382{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000245006Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.382{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000245005Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.381{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245004Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.381{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9trueSplunk, Inc.Valid 10341000x8000000000000000245003Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.380{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245002Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.380{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245001Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.380{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245000Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.380{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000244999Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.380{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000244998Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.380{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000244997Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:32.380{8D845A55-24FC-6260-FA02-000000004402}5344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000245159Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.750{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe 734700x8000000000000000245158Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.749{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000245157Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.747{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000245156Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.747{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000245155Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.584{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000245154Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.583{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000245153Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.583{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000245152Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.582{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000245151Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.581{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000245150Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.580{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000245149Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.580{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000245148Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.574{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000245147Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.573{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000245146Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.573{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000245145Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.573{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000245144Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.573{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000245143Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.572{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000245142Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.572{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\winspool.drv10.0.14393.4704 (rs1_release.211004-1917)Windows Spooler DriverMicrosoft® Windows® Operating SystemMicrosoft Corporationwinspool.drvMD5=FBB483E6A34C0E6772984FD93573CB4A,SHA256=170792721871CF37C76CD2F662DFE92568E2EBDC45075B974D2125249BB6398D,IMPHASH=396555AAEAB1402915E17EE8C257B7CFtrueMicrosoft WindowsValid 734700x8000000000000000245141Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.572{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000245140Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.572{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000245139Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.572{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000245138Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.572{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000245137Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.572{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000245136Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.572{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000245135Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.572{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000245134Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.571{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000245133Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.571{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000245132Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.571{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000245131Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.571{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000245130Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.571{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000245129Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.571{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000245128Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.571{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000245127Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.570{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000245126Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.570{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000245125Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.570{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000245124Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.570{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000245123Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.569{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000245122Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.569{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000245121Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.569{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245120Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.569{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x8000000000000000245119Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.566{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245118Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.565{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000245117Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.565{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000245116Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.565{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245115Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.565{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exeMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9trueSplunk, Inc.Valid 10341000x8000000000000000245114Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.564{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245113Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.564{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245112Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.564{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245111Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.564{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245110Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.564{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000245109Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.563{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000245108Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.563{8D845A55-24FD-6260-FC02-000000004402}1312C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.2.5Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=40AB9FBBAEDDA47FD9B0A2EC5E183B97,SHA256=8A7CB60452D38C258714CE37C2C490E78007A9E4F4F9A94B270BDBA59FA8F1AE,IMPHASH=35240A25EDE7EC5A65BF627E57E772B9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000245107Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.562{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245106Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.562{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D47AA30C1E94DB11AF97A47EB7A7ADB8,SHA256=DED5B3B8435D59838B1650A7AD3CCAB73459C8B0D61CA30078866C7427DC11A5,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000245105Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.080{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe 734700x8000000000000000245104Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.078{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x8000000000000000245103Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.078{8D845A55-24FC-6260-FB02-000000004402}51122456C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+610325|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60fe56|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60943|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+60f97|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+9e7f20|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245102Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.071{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000245101Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.070{8D845A55-24FC-6260-FB02-000000004402}5112C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 11241100x8000000000000000245100Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.047{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245099Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:33.047{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=924CED27A46FF26550E526F4B38EA166,SHA256=F7FBAF5A9B7C70F9D898E384811F91D36AA6C73EBB6B68C2E96363040E7C7725,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245162Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:34.895{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000245161Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:34.895{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=97028B3CDB3FDD90CB34FC96CECB5C24,SHA256=17FEB7E317406260A6E68A6501110D2467666E4C908AC1044790AFE3EDAF46F8,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245160Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:30.632{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56254-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245166Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:35.972{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245165Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:35.972{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=82401D5609C4769A5DD839B3674C8888,SHA256=B8EC240E95E6C6AAF61A12E0EC0F8515D14FF4E38440846C6B6DD0E74993E358,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245164Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:35.099{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245163Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:35.099{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=24EDD3F5832ABAD5FAF750E5FAE4835D,SHA256=51FFFDEFE5648A3843574FF7C1C9B93A17599CC11A66829C028E723DA1723FA9,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245168Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:37.077{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245167Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:37.077{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0F5987892909FD3EAE13E2E40357118B,SHA256=6FD26B39B79D5680BB62BADBCBCFE3F6E2E75120553CEB7FF9197C38ABFD7305,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245170Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:38.184{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245169Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:38.183{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17ECDD8560776E0F79F02E0D4B1254B7,SHA256=AFAB86A81256DF9CE238F05B1114F87744172D425E0CD1F1838086E27940F2F1,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245173Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:36.457{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56255-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245172Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:39.287{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245171Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:39.287{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7911306F130DD6C389B7B1FB70A6ADD2,SHA256=E215C20C63A6157D47778F4B8E9F2B51544DA25D6F03CB5CA9459DCFD9F64F29,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245175Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:40.296{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245174Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:40.296{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4636CEC88D27E8F9BADA77D08C8B3D70,SHA256=D3A0547908D08D957066C4DCB2B447D6FE0B70F787F0A204BC9EDBCC021B5118,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245177Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:41.301{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245176Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:41.301{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71CD6E1FD74C0531537AB68E2CEEE5D2,SHA256=26516CF12AFDC2BF7B6E134CF8C9BD20956C12914313ECF3D4FF7423F63A4C79,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245179Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:42.404{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245178Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:42.404{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD2051B510E44B5E23144B62B8F1ED57,SHA256=DC4285A7B673C86DF4B19CD81FE508AB07B11AD12F678D6FC2706EBA1CB036F8,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245181Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:43.507{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245180Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:43.506{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=107B8B5EC89B01E72957586A710DE62A,SHA256=504DB86E805F4817DFE53E721F1182F09A7009CA00340BF272D6C993B4FFA5D7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245184Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:44.610{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245183Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:44.609{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F49D0E718CFF24FE667A194EC43B2360,SHA256=9DA356D267FEEF913C52A39EC1BCFBC2FC3BC143911D22DC85A8E20621F5330D,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245182Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:41.496{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56256-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245186Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:45.614{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245185Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:45.613{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=964301A533DA74319C1587A01755DC32,SHA256=82BDABF8EFD14E0DCC1223FA418827FA0F352E9E2404038164D988F6CD43C440,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245188Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:46.717{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245187Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:46.716{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D675969C259995CE0F89A49453BF4431,SHA256=EBE2216FAD045A29A1CE414984E1943C0BF60AC098A0685EBFDCA45E77470FE1,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245190Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:47.820{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245189Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:47.820{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=740AA1DB1EEEF4D75222B60D6D5D9062,SHA256=E82B94EACC75B99D54BDDFA0F0639829CFBC938AD3629BCA9C09D83CD90C1F8E,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245199Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:48.926{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245198Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:48.926{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79CE78DDD6E06003AD05D2C195E7E466,SHA256=97598F8C41438F14F9C70DAA9194A2B32166AB6A228E9FB34C3E8C5C1A1E0FC4,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000245197Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:21:48.468{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\C415B540-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_C415B540-0000-0000-0000-100000000000.XML 11241100x8000000000000000245196Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:48.467{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeC:\System Volume Information\DFSR\Config\Volume_C415B540-0000-0000-0000-100000000000.XML.TMP2022-04-20 15:21:48.467 13241300x8000000000000000245195Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:21:48.465{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\34368782-AD18-41EA-9DBB-4DCA5018EFF5\Config SourceDWORD (0x00000001) 13241300x8000000000000000245194Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-SetValue2022-04-20 15:21:48.465{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\34368782-AD18-41EA-9DBB-4DCA5018EFF5\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_34368782-AD18-41EA-9DBB-4DCA5018EFF5.XML 11241100x8000000000000000245193Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:48.464{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exeC:\System Volume Information\DFSR\Config\Replica_34368782-AD18-41EA-9DBB-4DCA5018EFF5.XML.TMP2022-04-20 15:21:48.464 10341000x8000000000000000245192Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:48.452{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245191Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:48.452{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 354300x8000000000000000245206Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:46.893{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local52114- 354300x8000000000000000245205Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:46.891{8D845A55-15AE-6260-3100-000000004402}2344C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local53400- 354300x8000000000000000245204Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:46.877{8D845A55-159D-6260-0D00-000000004402}900C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56257-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local135epmap 354300x8000000000000000245203Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:46.877{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56257-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local135epmap 10341000x8000000000000000245202Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:49.303{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245201Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:49.301{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245200Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:49.301{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 354300x8000000000000000245218Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:47.720{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56259-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000245217Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:47.720{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56259-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000245216Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:47.435{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56258-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245215Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:50.391{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000245214Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:50.391{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8F0651B4893B275905B2F24B7C0D0636,SHA256=A676545FF83AEB62A79739524CD4ACAB3606EF3E80116BDAC31FFCF2FC2D2BDB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000245213Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:50.305{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245212Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:50.305{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245211Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:50.131{8D845A55-159B-6260-0B00-000000004402}636808C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245210Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:50.128{8D845A55-159B-6260-0B00-000000004402}636808C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245209Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:50.128{8D845A55-159B-6260-0B00-000000004402}636808C:\Windows\system32\lsass.exe{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\system32\DFSRs.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000245208Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:50.033{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245207Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:50.033{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=172584C3B1C382378BE01CBFCC631FAE,SHA256=FC7152DBA3E0B856A8CA031896B5B6F1E54B3EB29CFD8003E2DBF6CF646ECBCD,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245222Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:48.548{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56260-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000245221Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:48.548{8D845A55-15AE-6260-2C00-000000004402}2960C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56260-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 11241100x8000000000000000245220Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:51.139{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245219Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:51.138{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5CC0900CE76004BE7190AA349DE1FFC,SHA256=FC65CBC142D7C4FCF9ED01F45278C9B7B2112A6F0F7DB13122B7008793524330,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245224Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:52.244{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245223Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:52.243{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2F23D8D3273EFEE000C72945B34B8565,SHA256=2A9C4CFB553D66C24395C87353D0239D38B3B1E33646A5C32E71139D2BCEEEDA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000245229Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:53.471{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\respondent-20220420141616-063MD5=8D93873C901538A8B2B909297EDAE7BB,SHA256=9423023AAA5D37B26F7EE3576993D2852CE2F95EF8E5E497C042A8474DDD26FD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245228Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:53.470{8D845A55-15B0-6260-4700-000000004402}3580C:\Program Files\Amazon\SSM\ssm-agent-worker.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\respondent-20220420141616-0632022-04-20 15:21:53.470 11241100x8000000000000000245227Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:53.468{8D845A55-15AE-6260-2D00-000000004402}2972C:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\tmp\surveyor-20220420141614-0642022-04-20 15:21:53.468 11241100x8000000000000000245226Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:53.348{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245225Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:53.347{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0D7679A1C5DE41038A04C3E3612E6A59,SHA256=16CB6CC68241E47BFBCBCB951B3E784BF0C43C007389282DE7D7D63AB430D4EE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000245234Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:54.469{8D845A55-15AE-6260-2D00-000000004402}2972NT AUTHORITY\SYSTEMC:\Program Files\Amazon\SSM\amazon-ssm-agent.exeC:\ProgramData\Amazon\SSM\InstanceData\i-0290f7bfe64a40509\channels\health\surveyor-20220420141614-064MD5=97EF2A570B75C4F95FC69B0D09A2E2A2,SHA256=11396EA313B0ED7E3228C4FA92ABE9D836DB8F416A7A8A28ACC77133025082E7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245233Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:54.453{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245232Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:54.453{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB7EA0AFBB265D16AEC85825F5257D62,SHA256=97EC35A19C66F9CCE4DDCFD55C37AA04A6934D25812209BE38EE2EFB2D12F75B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245231Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:54.040{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000245230Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:54.039{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=82F5AC0013182CC43C7A1A50F8E3AF03,SHA256=F5524D8C04505A73083A5EE0E18F67C7FAD7AB72D4FE04048A9C607D888A2581,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245236Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:55.556{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245235Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:55.556{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E728238EB870E25F013AF68F063288CF,SHA256=8FCBDAD7327FB824DA1D7D7BA29CD65D34EEE15C1550DA95739754A374375AB4,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245240Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:56.663{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245239Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:56.663{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B72EBB899B29F1D6C9228EB18794F7A7,SHA256=8729A06934E4D2EA0E0BF12F7D651B19F34D59566AF4C97E30ACC60C19DB8611,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245238Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:53.430{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56261-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245237Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:56.089{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:21:56.089 11241100x8000000000000000245242Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:57.667{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245241Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:57.667{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B83D53D52EC4C06688948617747C9081,SHA256=E3B3B02655817F6B83401C0694E92066F013545C5F289948A194EEFEEC450263,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245244Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:58.771{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245243Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:58.770{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73F0F03A44E196BA0C00BBCE34AFB0B6,SHA256=71782A67EF7BB3D2EB581E9B130159DEC5F24C452267F9102866F23B43373DE7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245251Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:59.779{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245250Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:59.778{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9A5EE15BF219A8B69EA2750F63960481,SHA256=67995619D8D66927DBAEDFEA7A975F676C05C9A5FBFD7883170092EAD945E340,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000245249Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:59.695{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=32110CA6781E6F89B49EEC5AE984C7A7,SHA256=66E67A2A7F346E401DE97BC16C512C845CD7EF05923E7152E57B1B851EE11BD7,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245248Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:59.282{8D845A55-159D-6260-1100-000000004402}416C:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat2022-04-20 14:15:57.498 23542300x8000000000000000245247Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:59.282{8D845A55-159D-6260-1100-000000004402}416NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=1CA6D0446B259B9B03818A682E7AFD11,SHA256=697AD6FCA12255B1B24DC59251A47F0041B0641C5C49F935F9E347FAF0B7168B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245246Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:59.050{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000245245Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:59.050{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=91BBBBF78CBB7F5D146766AABA573EFE,SHA256=E9D2C2D9ABA858E7E940A1C9D83A2B59C4AAA14925000653EFF6E3A2B3FFC139,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245253Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:00.881{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245252Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:00.881{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D55AE2BF410811C794B6D08407F92C74,SHA256=E2CB1A2738529794DE28C7233ABF61B32E11BC8F56D558928F9B7824A190A9AD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245256Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:01.984{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245255Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:01.984{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9AC918C4402E0C1BF55E2E30D7C41A58,SHA256=A3083AA0063537D6E4A8B5F1F14DD67C766C05FBDE41FF8DB7D1F1020C491AED,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245254Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:21:58.458{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56262-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245260Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.377{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xml2022-04-12 13:20:00.173 23542300x8000000000000000245259Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.377{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=05FFF3FF76A710A0F458E3D636098363,SHA256=23DCF606AD488F459E6EEC044C3A8EDA5AC21ED69138FFC21A2AC72C77BD3B13,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245258Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.089{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245257Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.089{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=769FF192CD3D2F67F5B860A0C2BEEB1E,SHA256=B1EBC7086CFE3B407E1D658959D0D162B90D91E608E2BBD9B76A175DB7453023,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245263Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:01.785{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56263-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8089- 11241100x8000000000000000245262Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:04.194{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245261Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:04.194{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AA251208B043F57C8AB92789FD6577F,SHA256=6464B8F7A9BED0636573F95772706D823012A293DAF0E93E16F53CEFD1DF689F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000245268Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:05.502{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-1596-6260-0100-000000004402}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+97022|C:\Windows\system32\kerberos.DLL+794d4|C:\Windows\system32\kerberos.DLL+1443f|C:\Windows\system32\lsasrv.dll+2f1f1|C:\Windows\system32\lsasrv.dll+2d0d6|C:\Windows\system32\lsasrv.dll+32919|C:\Windows\system32\lsasrv.dll+30267|C:\Windows\system32\lsasrv.dll+2f1f1|C:\Windows\system32\lsasrv.dll+1752d|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e 10341000x8000000000000000245267Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:05.392{8D845A55-159B-6260-0B00-000000004402}636760C:\Windows\system32\lsass.exe{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245266Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:05.383{8D845A55-159B-6260-0B00-000000004402}636684C:\Windows\system32\lsass.exe{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\lsasrv.dll+6ea9c|C:\Windows\system32\lsasrv.dll+e6b44|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 11241100x8000000000000000245265Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:05.299{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245264Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:05.299{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=959B4845AA8A085697185AA67F60DAA1,SHA256=A780A8729A3C7DF7559EE988D9A4A5CC06FD560DE82CA074F74447322199BFF2,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245279Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.923{8D845A55-1596-6260-0100-000000004402}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56267-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local445microsoft-ds 354300x8000000000000000245278Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.923{8D845A55-1596-6260-0100-000000004402}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56267-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local445microsoft-ds 354300x8000000000000000245277Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.815{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56266-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000245276Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.815{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56266-false10.0.1.14win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000245275Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.808{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56265-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000245274Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.808{8D845A55-159D-6260-1600-000000004402}1292C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local56265-truefe80:0:0:0:64fe:9077:35e3:965ewin-dc-ctus-attack-range-355.attackrange.local389ldap 11241100x8000000000000000245273Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:06.439{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000245272Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:06.439{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A48CF0C009499151C2E18C48AC9281D2,SHA256=8FA636D07FA962211AFB576BDF72015DC7C46FC439627986F2735E9FD1AABB24,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245271Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:06.403{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245270Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:06.403{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=10734C9196DB2598F291F266C2AED64D,SHA256=2E5ED717DB96CCD8CFCD79117A9BE424CBEDE788378A471DA37376CAA4963D02,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245269Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:03.515{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56264-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245281Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:07.408{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245280Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:07.407{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E0C6BCBED5B34E265FDFA4E106AB7400,SHA256=C9BD87D7CEABF9734FCDE922F90194D326EA0B264B67479D61CC988B4953EAF3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245283Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:08.511{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245282Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:08.511{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B0FCAA3392EF99980C44F8F94DF02F5A,SHA256=318265B5502D63D36C26D919A4DA789A6CF6813EB5D1B4E941FD876866E4F20C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245285Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:09.613{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245284Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:09.613{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=466B83B363505DB882C72B82A64401C1,SHA256=CA861E2AB6DEF8DE7A8BB25937F8ACE0A6DC0F9C2B664D8F3566C064D34AE22D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245287Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:10.716{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245286Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:10.716{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B8B95DF2A142A75B98A5335B9604BBF,SHA256=BD8309B3D19ACB67362585E6CB4A9735F49FDD429E5D63E1DCACA7AA46FB9F65,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245289Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:11.821{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245288Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:11.820{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74BF21224FBD7C9CA93FA30DE60A57DC,SHA256=F0FECA0E1799E678B159463BBCB2230343220458EEC00DEE2DD707DD64053C71,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245292Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:12.825{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245291Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:12.825{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF2FEBBDA4EAEEEEBC1F95A2EE456FF0,SHA256=BB16A669274E72E6E8CF244BB9B1ACEAE692FF6B0B1B8E4D0892372ECAAF3CCF,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245290Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:08.563{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56268-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245294Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:13.828{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245293Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:13.827{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC70900ACBFD47E0870598D79BF92948,SHA256=00A60F055B89AC98C3AFAA5243CE5E6B3208A0DAEEA9D4261C5F37680985D8A6,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245296Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:14.933{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245295Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:14.932{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5239FF8C2ECA9D52B6BF629FD7C83785,SHA256=BCCF717CCB13333D4D904327F10923717D97631226E435BECF035C537E8ECE4F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245298Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:15.939{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245297Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:15.938{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9FBAD103596D1C592846BBE77B968B74,SHA256=937237FDAA165FF15B59096EDD420AB66EB2ADA292A2A98D226BD7C61C9B36D4,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245299Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:13.639{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56269-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245303Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:17.267{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000245302Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:17.267{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=174B20302D8930C431522C08449AABAA,SHA256=77A86562AAE07F19809539912E9E70D08A06F572DC8C1346993CF973D13D1219,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245301Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:17.042{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245300Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:17.042{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F54DD4052BE1D234458EA6C4D1CC69F,SHA256=2D25EE32C9F416F799D59B92DF8EB2D2F3965C1B5AF11E59B4E49F71A46B92DB,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245305Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:18.146{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245304Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:18.146{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=49476AA966ECEA8A841F8881073A7ED2,SHA256=5D86598913BD6D0DDB2C3855E30D8984BB650926909F38F537EF08EFEC8AD548,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245309Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:19.249{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245308Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:19.249{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A30E955BB841B570DFBF4E93B7E418C3,SHA256=D0508E15B1D78A55C3D3FE4A547DDAF33556AD9AC9F6FF33394C2B8B878F6F0F,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245307Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:19.100{8D845A55-1AE7-6260-9101-000000004402}6032C:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.bin2022-04-12 13:31:22.993 23542300x8000000000000000245306Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:19.099{8D845A55-1AE7-6260-9101-000000004402}6032ATTACKRANGE\AdministratorC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\1huziwj5.default-release\datareporting\glean\db\data.safe.binMD5=D4C20081083A1C88A87377592C63F96D,SHA256=77546C8E25135D5FD69D2769FDE399DB7FA9415B76DCFF08CA2D638FE9ED3BA8,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245311Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:20.355{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245310Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:20.355{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DE3FAB3F31546EB6C97E7D5570AE150,SHA256=B82A6B7C12CA1DF6235DEC3A0B6B35A8C814475700CAABA492FC5F900DFC48D3,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245313Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:21.459{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245312Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:21.458{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D9B8B1766BE9ADD9B1043F082888D0B,SHA256=12628B1C4A74C3720E2C4F605ECE1455657410858E3AA0198F42E30F7CE92D52,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245316Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:19.452{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56270-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245315Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:22.564{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245314Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:22.563{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8936909B8E09894C0980EB2891DC9299,SHA256=E2642CAB180B1781227A5D2981AFA5AEE75A51186656ECC6A586F1AA71672E6C,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245318Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:23.669{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245317Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:23.669{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB355B8E9BB3AA40E0F892F8578483F8,SHA256=5D97018ABDB7021D558B3E300FD31832D4CC44CD90F47CF97CA1C093D7494ED5,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245320Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:24.673{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245319Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:24.673{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0049A064B50F0554764675963DF320D6,SHA256=D277EB029CD9AADC9EBF998414D5EBC0FEEDCC6505D88DA900571F3404FD69A1,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245322Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:25.779{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245321Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:25.778{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08D2B42476667B2659FE4504D11689BE,SHA256=08A8555924CA4A91C23576D92D327DA70F8CC4CBFC0305AA5D80EB5FDE5A25AA,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245325Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:26.886{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245324Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:26.886{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B287EE595AAB721F52C8F6C98EC3DBFB,SHA256=017699F6769D78CE606B745F87BAB37F39EE45400909450D94C0C08C3A03E2DC,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245323Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:26.087{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log2022-04-20 15:22:26.087 11241100x8000000000000000245327Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:27.989{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245326Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:27.989{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12F2D8B2B4FE84CA86B8DFDC7B54DE50,SHA256=8F1A5DC2AC5844EBEAA6FF492BA5E891BE2CBB992D42AB6F5314AA73116A769B,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000245367Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:24.509{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56271-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 10341000x8000000000000000245366Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.268{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245365Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.268{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245364Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.268{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245363Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245362Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245361Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245360Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245359Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245358Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245357Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245356Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245355Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245354Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245353Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245352Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245351Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245350Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245349Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245348Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245347Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245346Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.267{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245345Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15DF-6260-9400-000000004402}4324C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245344Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245343Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245342Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245341Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245340Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245339Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245338Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E2-6260-9600-000000004402}4560C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245337Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245336Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245335Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245334Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.266{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245333Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.265{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245332Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.265{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245331Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.265{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245330Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.265{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15E1-6260-9500-000000004402}1492C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245329Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.265{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-3000-000000004402}2368C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3b54b|c:\windows\system32\rpcss.dll+3a39a|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245328Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:28.265{8D845A55-159D-6260-0D00-000000004402}900920C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-3000-000000004402}2368C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+2db91|c:\windows\system32\rpcss.dll+3a274|c:\windows\system32\rpcss.dll+2b9ce|c:\windows\system32\rpcss.dll+2a8d3|c:\windows\system32\rpcss.dll+462b6|c:\windows\system32\rpcss.dll+46762|c:\windows\system32\rpcss.dll+4906f|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14422|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 23542300x8000000000000000245426Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.907{8D845A55-15AE-6260-2E00-000000004402}3040NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.logMD5=450C205EDDF7668CCE747BC4984077C8,SHA256=E2F2694E9FFD6016D097A8B8CE85A14BA9DD7F9C6E1EA0CE621924888267E339,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000245425Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.700{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe 734700x8000000000000000245424Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.699{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000245423Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.698{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000245422Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.697{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 11241100x8000000000000000245421Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.574{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245420Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.573{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1CC1F694C82D0D17FCC0332F3800ED4F,SHA256=A9B2F8AB340345462DDC2F247F72DC707D8A183B7527834FBC80E166459ADD3C,IMPHASH=00000000000000000000000000000000falsetrue 734700x8000000000000000245419Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.526{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000245418Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.526{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000245417Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.525{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000245416Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.525{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000245415Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.523{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000245414Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.523{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000245413Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.523{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000245412Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.522{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000245411Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.516{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sspicli.dll10.0.14393.5006 (rs1_release.220301-1704)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsspicli.dllMD5=F0258C58C8DC45AF9B5AAF9BA49E0C53,SHA256=8E1EAA39742CC0E97D615229E9C13C8447B8D115B4678A1F03BE3E8E20345521,IMPHASH=4B1C9487A6420C18F688F0EC5BEB6F33trueMicrosoft WindowsValid 734700x8000000000000000245410Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.516{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000245409Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.515{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000245408Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.515{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000245407Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.515{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000245406Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.514{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000245405Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.514{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000245404Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.514{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000245403Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.514{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000245402Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.514{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000245401Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.514{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000245400Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000245399Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000245398Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000245397Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000245396Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000245395Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245394Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000245393Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000245392Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000245391Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000245390Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.513{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000245389Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.512{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\nsi.dll10.0.14393.3297 (rs1_release_1.191001-1045)NSI User-mode interface DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationnsi.dllMD5=994E2A6D2A0B38E0968B3998E42033AC,SHA256=491F2D1DE09C39B324BCF5800198AC7CCE755F4023F1FEB3854D33716461BC27,IMPHASH=B01B7830101BC0D5FBDE4FFE2B170CF7trueMicrosoft WindowsValid 734700x8000000000000000245388Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.512{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000245387Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.512{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\IPHLPAPI.DLL10.0.14393.2339 (rs1_release_inmarket.180611-1502)IP Helper APIMicrosoft® Windows® Operating SystemMicrosoft Corporationiphlpapi.dllMD5=3CD38EDF9CA12F91131EDEE32D1C9DF5,SHA256=AF2440640BF8BDEAAF0DECDD7C354158E415ED0AA340ABA7A6CCCDC09C1E728B,IMPHASH=98738BA55485CCA932F6D222F47FFC55trueMicrosoft WindowsValid 734700x8000000000000000245386Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.512{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000245385Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.512{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\dnsapi.dll10.0.14393.4350 (rs1_release.210407-2154)DNS Client API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationdnsapiMD5=D7651F99299B13D576A72643BFC44944,SHA256=589302E630C473DBDF4CE92C59F00B029FCA0C228E7111A764166E16025FA1A9,IMPHASH=3C043C6FF0F62DAEB8819606F79C5ECCtrueMicrosoft WindowsValid 734700x8000000000000000245384Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.512{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\secur32.dll10.0.14393.2273 (rs1_release_1.180427-1811)Security Support Provider InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationsecur32.dllMD5=BCF1B2F76F8A3A3E9E8F4D4322954651,SHA256=46B327CD50E728CBC22BD80F39DCEF2789AB780C77B6D285EEB90126B06EEEB5,IMPHASH=0D8FF9DE2DA5C07D680347B1A098E759trueMicrosoft WindowsValid 734700x8000000000000000245383Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.511{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000245382Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.511{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000245381Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.511{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000245380Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.511{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 10341000x8000000000000000245379Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.510{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245378Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.509{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000245377Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.509{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000245376Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.509{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245375Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.509{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exeMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52trueSplunk, Inc.Valid 10341000x8000000000000000245374Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.508{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245373Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.508{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245372Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.508{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245371Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.508{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245370Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.508{8D845A55-159A-6260-0500-000000004402}4204820C:\Windows\system32\csrss.exe{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000245369Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.508{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000245368Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.507{8D845A55-2535-6260-FD02-000000004402}5332C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.2.5Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=92BD3C71158FA8B9A0821D43564A56E7,SHA256=7850C91F8D08679D7A0579D350C08CA6F6EDEA8A12226ADC2E30B4ABF8CE0BE2,IMPHASH=FD2D4472615B421BAEF1D51F46EF5F52{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000245538Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.996{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe 10341000x8000000000000000245537Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.994{8D845A55-2536-6260-FF02-000000004402}10886052C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae795|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6ae2c6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+643d8|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+65dfc|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+9dcf50|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245536Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.994{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000245535Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.994{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000245534Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.864{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000245533Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.864{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000245532Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.863{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000245531Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.863{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000245530Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.861{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000245529Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.861{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000245528Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.861{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000245527Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.860{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000245526Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.860{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 354300x8000000000000000245525Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:27.730{8D845A55-159B-6260-0B00-000000004402}636C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56272-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 354300x8000000000000000245524Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:27.730{8D845A55-15AE-6260-2B00-000000004402}2952C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local56272-true0:0:0:0:0:0:0:1win-dc-ctus-attack-range-355.attackrange.local389ldap 734700x8000000000000000245523Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.853{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000245522Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.853{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000245521Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.853{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000245520Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.853{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000245519Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.853{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000245518Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.853{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000245517Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.853{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000245516Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.853{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000245515Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.852{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000245514Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.852{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000245513Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.852{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000245512Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.852{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000245511Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.852{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000245510Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.852{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000245509Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.852{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 734700x8000000000000000245508Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.851{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000245507Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.851{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000245506Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.851{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000245505Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.851{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000245504Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.850{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000245503Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.850{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000245502Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.850{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000245501Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.849{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000245500Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.849{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000245499Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.849{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000245498Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.849{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245497Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.849{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 10341000x8000000000000000245496Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.848{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245495Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.847{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000245494Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.847{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000245493Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.847{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245492Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.847{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exeMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2trueSplunk, Inc.Valid 10341000x8000000000000000245491Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.846{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245490Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.846{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245489Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.846{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245488Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.846{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245487Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.846{8D845A55-159A-6260-0500-000000004402}420356C:\Windows\system32\csrss.exe{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000245486Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.846{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000245485Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.846{8D845A55-2536-6260-FF02-000000004402}1088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.2.5Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=611F936426EC989CDC9FB43B692D3CFA,SHA256=AF94FF9B82C4BF6F27A5695E741D2BDF06A6A574924179D0BC9E7B8A725882F5,IMPHASH=A2763C4BA6D4717F662584401724A6B2{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 11241100x8000000000000000245484Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.600{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245483Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.600{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=35CD8B54A18917F0EA2F9E493C791227,SHA256=A0A463021AA0E02B7CD829BC3A301A6D967C0E933BEA1257734D195DF9EFB51B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245482Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.595{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 11241100x8000000000000000245481Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.595{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Security2022-04-12 13:19:12.909 23542300x8000000000000000245480Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.595{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F70B7D87116B0860C9ABA879EB925410,SHA256=D0C7719E21671574113B9E5662D6F242DE85C680DAF2027736DC5101CB234CF2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000245479Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.595{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=3D2039F94F309C3D65842DCA1619C09E,SHA256=F94E3269234FFE98377EBE51C15D012E8F291D15EECA712CA38B31B535FBFA3C,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000245478Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.363{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe 734700x8000000000000000245477Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.363{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 734700x8000000000000000245476Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.361{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000245475Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.361{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000245474Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.207{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000245473Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.207{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000245472Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.206{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000245471Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.205{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000245470Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.204{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000245469Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.204{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000245468Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.204{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000245467Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.203{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000245466Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.197{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000245465Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.197{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000245464Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.196{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000245463Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.196{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000245462Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.196{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000245461Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.196{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000245460Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.196{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000245459Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.195{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000245458Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.195{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245457Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.195{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000245456Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.195{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000245455Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.195{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000245454Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.195{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000245453Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.195{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000245452Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.195{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000245451Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.192{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000245450Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.192{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000245449Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.192{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000245448Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.190{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000245447Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.190{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000245446Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.190{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000245445Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.190{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000245444Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.190{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000245443Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.190{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000245442Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.189{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000245441Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.189{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000245440Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.189{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\fltLib.dll10.0.14393.0 (rs1_release.160715-1616)Filter LibraryMicrosoft® Windows® Operating SystemMicrosoft CorporationfilterLib.dllMD5=051ABD8360BDA63A1BC77C662FBF0A25,SHA256=C914E2DBAEC2C9A11923A984B30A979637D3A27B3C29E93F4C90FB1D9FBC518F,IMPHASH=74D3C2DA8B6F9861866B866AE40683D3trueMicrosoft WindowsValid 734700x8000000000000000245439Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.189{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000245438Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.188{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245437Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.188{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000245436Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.187{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000245435Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.187{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245434Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.187{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exeMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02DtrueSplunk, Inc.Valid 10341000x8000000000000000245433Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.187{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245432Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.186{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245431Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.186{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245430Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.186{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245429Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.186{8D845A55-159A-6260-0500-000000004402}420536C:\Windows\system32\csrss.exe{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000245428Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.186{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000245427Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:30.186{8D845A55-2536-6260-FE02-000000004402}4460C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=679D3E04F6AB7B10FF27D06B29C27A12,SHA256=FF1B5220C99EA6173BE693E1C2D700873ADE2F8A73F503FC0D297EA0792756D1,IMPHASH=05D58741E22C6453F52C1A9326FAF02D{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 534500x8000000000000000245590Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.870{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 734700x8000000000000000245589Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.869{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x8000000000000000245588Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.869{8D845A55-2537-6260-0003-000000004402}34405352C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245587Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.868{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000245586Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.868{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000245585Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.736{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000245584Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.736{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000245583Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.735{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000245582Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.735{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000245581Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.733{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000245580Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.733{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000245579Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.733{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000245578Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.732{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000245577Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.726{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000245576Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.726{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000245575Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.726{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000245574Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.726{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000245573Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.725{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000245572Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.725{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000245571Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.725{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000245570Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.725{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000245569Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.725{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245568Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.725{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000245567Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.725{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000245566Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000245565Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000245564Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000245563Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000245562Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000245561Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000245560Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000245559Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000245558Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000245557Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000245556Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.724{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000245555Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.723{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000245554Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.723{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000245553Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.723{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000245552Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.723{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000245551Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.723{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000245550Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.722{8D845A55-15AF-6260-3A00-000000004402}32923312C:\Windows\system32\conhost.exe{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245549Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.722{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\KernelBase.dll10.0.14393.5006 (rs1_release.220301-1704)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationKernelbase.dllMD5=82A6381DD5A8F0E41E0DD8F382612A81,SHA256=EB5D7DD96CEF7AE80B40F63272584FD483967135C4BCEAE697528004A238923C,IMPHASH=05349EBAA635D77714868763D44881E9trueMicrosoft WindowsValid 734700x8000000000000000245548Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.721{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel32.dll10.0.14393.4651 (rs1_release.210911-1554)Windows NT BASE API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel32MD5=0AAB61CE538011C286B367815A98E5EE,SHA256=C5895455873186AA467ECC9DBF9C2F73A0AEC5CF5E1357C0700D88D20DE2412F,IMPHASH=3CE0779E0F4E275CD51A359A98CCC682trueMicrosoft WindowsValid 734700x8000000000000000245547Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.721{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ntdll.dll10.0.14393.5006 (rs1_release.220301-1704)NT Layer DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationntdll.dllMD5=F5EE39B17A8BCDEDC3D40997C26F62B1,SHA256=11C1C88B1CC11D9800DEEF27ED7ABDFDE3DC852687A3B9FBD5153284106E5952,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245546Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.721{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----MD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9trueSplunk, Inc.Valid 10341000x8000000000000000245545Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.720{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245544Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.720{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245543Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.720{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245542Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.720{8D845A55-159C-6260-0C00-000000004402}8444504C:\Windows\system32\svchost.exe{8D845A55-15AE-6260-2F00-000000004402}1212C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a523|C:\Windows\System32\RPCRT4.dll+d5bc1|C:\Windows\System32\RPCRT4.dll+52cfc|C:\Windows\System32\RPCRT4.dll+358a4|C:\Windows\System32\RPCRT4.dll+347bd|C:\Windows\System32\RPCRT4.dll+3506b|C:\Windows\System32\RPCRT4.dll+20e5c|C:\Windows\System32\RPCRT4.dll+212dc|C:\Windows\System32\RPCRT4.dll+1049c|C:\Windows\System32\RPCRT4.dll+11cfb|C:\Windows\System32\RPCRT4.dll+1a58a|C:\Windows\SYSTEM32\ntdll.dll+1d35e|C:\Windows\SYSTEM32\ntdll.dll+1ecc9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 10341000x8000000000000000245541Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.720{8D845A55-159A-6260-0500-000000004402}420436C:\Windows\system32\csrss.exe{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5179f 10341000x8000000000000000245540Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.720{8D845A55-15AE-6260-2E00-000000004402}30403752C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7414|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b346|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+e499f1|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b3255|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd30d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1b59b6|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd3c14|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bd79a|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1c0f1c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd07d2|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dd491d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+1bb965|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+dc694e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 154100x8000000000000000245539Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:31.719{8D845A55-2537-6260-0003-000000004402}3440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{8D845A55-159B-6260-E703-000000000000}0x3e70SystemMD5=82B4C70E6AA15CE4AABB631DA73429A2,SHA256=80ECB7DFA33366FD12D6796A32E0435355F620DA83A8894D00BBAB09197A0F10,IMPHASH=1BDECF92268D3D3EF70015DDFEB0FFB9{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x8000000000000000245649Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:29.539{8D845A55-15B9-6260-7900-000000004402}3332C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-ctus-attack-range-355.attackrange.local56273-false10.0.1.12ip-10-0-1-12.us-east-2.compute.internal8000- 11241100x8000000000000000245648Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.773{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245647Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.773{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B10F99EA57C779457BDF126D962F70F,SHA256=E46BF8EE9A8D9DCF6409633263C561C9E35A08E9A8D07970E40B91F66934EBCD,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000245646Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.639{8D845A55-15C1-6260-8300-000000004402}776C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_Operational2022-04-12 13:22:35.754 23542300x8000000000000000245645Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.639{8D845A55-15C1-6260-8300-000000004402}776NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D33D37F3DA4A8675D3E55859886DB02,SHA256=3F489B53AD3DAECB5AE0C5C6239B00D62D618B8FC8FC43F599A1B30B72B12FCD,IMPHASH=00000000000000000000000000000000falsetrue 534500x8000000000000000245644Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.534{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe 734700x8000000000000000245643Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.532{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\kernel.appcore.dll10.0.14393.2312 (rs1_release.180607-1919)AppModel API HostMicrosoft® Windows® Operating SystemMicrosoft Corporationkernel.appcore.dllMD5=0AF5EF8A7FEFD4B37036B71514FC20CF,SHA256=D4F178583F6F33794D42B4DB11008494E9CD9F069C2AD2CA304DA63F9B5F659C,IMPHASH=94524C03C5380F78283785F1E05E667DtrueMicrosoft WindowsValid 10341000x8000000000000000245642Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.532{8D845A55-2538-6260-0103-000000004402}28082348C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{8D845A55-15AE-6260-2E00-000000004402}3040C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6144|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+606005|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+605b36|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+75996|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+9dd220|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51791 734700x8000000000000000245641Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.532{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbgcore.dll10.0.14321.1024 (debuggers(dbg).210127-1811)Windows Core Debugging HelpersMicrosoft® Windows® Operating SystemMicrosoftDBGCORE.DLLMD5=72E8FEC8419AB470FB737883463688FE,SHA256=1DA7D2D2D1C4E6EC17101A4997C4AA610818730D63C72C1D2084ABA3F25C5146,IMPHASH=F67CBD9561C1FEF51B817BA184E81D2EtrueMicrosoft WindowsValid 734700x8000000000000000245640Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.531{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\dbghelp.dll10.0.14321.1024 (rs1_release.160715-1616)Windows Image HelperMicrosoft® Windows® Operating SystemMicrosoftDBGHELP.DLLMD5=2C92DF5D32661FB4B81B08B72B2102A7,SHA256=BCEF4DEBDE7D8D6916EE3D3E5E63A725E03A058AABCD7DD49DF9D48B16E96D1A,IMPHASH=E7FD2920222985E31019D022BB39EFBEtrueMicrosoft WindowsValid 734700x8000000000000000245639Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.400{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptbase.dll10.0.14393.0 (rs1_release.160715-1616)Base cryptographic API DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptbase.dllMD5=51FCB0FDEFCB9A3E4A1DC8C8673BC63C,SHA256=63A0E1A76B7ABCF56E44B548568649FFB6B5609402746D48A4DC77CCED20F5FE,IMPHASH=9E9C9DFD04CDDF2B6F1412BF096AEAF4trueMicrosoft WindowsValid 734700x8000000000000000245638Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.399{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rsaenh.dll10.0.14393.4467 (rs1_release.210604-1844)Microsoft Enhanced Cryptographic ProviderMicrosoft® Windows® Operating SystemMicrosoft Corporationrsaenh.dllMD5=28140830C342F475A597B2D54C42DFFA,SHA256=99E23D0177C6DC59AD72DEEC46CFB995828EF567F001261BC65532B6DDEAD862,IMPHASH=C918D75BDB7774C087BB6C0C9C0A7686trueMicrosoft WindowsValid 734700x8000000000000000245637Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.399{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\cryptsp.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptographic Service Provider APIMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptsp.dllMD5=9500AE4C4B639FEAEED0CC6C39F45149,SHA256=C1055D4B9A854282336A5404CA0FCB1A2EBC3417600035338C9CDFC7B8D0778C,IMPHASH=96CBD1B5C0EA88B677BA3BB5FD009869trueMicrosoft WindowsValid 734700x8000000000000000245636Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.398{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\srvcli.dll10.0.14393.0 (rs1_release.160715-1616)Server Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationSRVCLI.DLLMD5=656F846CAED76C6FC5C76E8BACEF4EF6,SHA256=DFDE27C086764ACC1EA3E6A4E2BA50C2AB532F9E1D99203861F51910A8D850FB,IMPHASH=B15A9E7274075AC5A54930989FAC32E4trueMicrosoft WindowsValid 734700x8000000000000000245635Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.397{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcrypt.dll10.0.14393.4583 (rs1_release.210730-1850)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcrypt.dllMD5=63231EA984BC614584102A96D4F35CB4,SHA256=13C5BD283C01B0D50D8D0D99E88FC67F9234FA14A6860AB2B6EE552199FF6A74,IMPHASH=7C2E79D83754439DC7DE7882DCB4238DtrueMicrosoft WindowsValid 734700x8000000000000000245634Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.397{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\wkscli.dll10.0.14393.4886 (rs1_release.220104-1735)Workstation Service Client DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWKSCLI.DLLMD5=001C755958B4216CE8E4277273CF9A35,SHA256=46C4BEA93D30D2D9E622D981AC874B7E0B1A1204BA5D1EEE1ECA7B4E360E6B56,IMPHASH=6990BA83B94C81786A84E6C44E699D03trueMicrosoft WindowsValid 734700x8000000000000000245633Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.396{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netutils.dll10.0.14393.0 (rs1_release.160715-1616)Net Win32 API Helpers DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNETUTILS.DLLMD5=504739A17F3A05531258784275A6F375,SHA256=A931C54C47B454407990241DB12BD209AC219C55F026ADDED427A9E84A409923,IMPHASH=7D1B32891B9173ED71ED6C18DEFEE578trueMicrosoft WindowsValid 734700x8000000000000000245632Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.396{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\netapi32.dll10.0.14393.5006 (rs1_release.220301-1704)Net Win32 API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationNetApi32.DLLMD5=F00A9E801A540DD523162523F1B23E5D,SHA256=A76A07EDCD042C9123CC9E1438E517540302401C01145BF3D0205C51A5231B8A,IMPHASH=FE007B4B6CED5075C98434207FFF87E0trueMicrosoft WindowsValid 734700x8000000000000000245631Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.390{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\msvcp140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationmsvcp140.dllMD5=BA72C2F6F465926980ADC2FB7F8B3490,SHA256=86881A7054532019291C162F0A8177980C1C2B45490F7E88543F22915D08D9FF,IMPHASH=ADF99B9EA3A1F76C33522F96772BC4DDtrueMicrosoft CorporationValid 734700x8000000000000000245630Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.390{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcp_win.dll10.0.14393.2999 (rs1_release_inmarket.190520-1518)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcp_win.dllMD5=C50C0CEFA633773AB29572E05834F1FE,SHA256=50178F23AA57B31626614C6C65DA2B6518A64FF684FFA18A0F49C4431DFCBEC5,IMPHASH=5B59892514923CABE9B70CFE22A3F59AtrueMicrosoft WindowsValid 734700x8000000000000000245629Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.389{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\oleaut32.dll10.0.14393.4402 (rs1_release.210426-1725)OLEAUT32.DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationOLEAUT32.DLLMD5=57B07BF89C63FA60A810FEDE496126CA,SHA256=080632F80FA2A387E5A55C670FFE07C927D553FDDA26F7F8B4156C0C6B20E75E,IMPHASH=8987D71C85BB2C13D3D90194331F962FtrueMicrosoft WindowsValid 734700x8000000000000000245628Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.389{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\bcryptprimitives.dll10.0.14393.4770 (rs1_release.211101-1440)Windows Cryptographic Primitives LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationbcryptprimitives.dllMD5=54417B63FB3760BC6DBC5DB1BDA4C272,SHA256=B7A8B457B252AB949C067D5FCFEFB2AE98E9115B958D2A0FC120D7B13B3E9FAD,IMPHASH=BA5C37A1CF8C2730ED1F4DA1587496A5trueMicrosoft WindowsValid 734700x8000000000000000245627Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.389{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\combase.dll10.0.14393.5006 (rs1_release.220301-1704)Microsoft COM for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationCOMBASE.DLLMD5=A9D9CF5B5FD3E1D15724B39C1EAF20AE,SHA256=EA7E52ACB9E23D08A2290F2685E90BA2F87826685BD5BA2B3B12676FB3CA4989,IMPHASH=0863DD72CA0C3702DB7ACD19A4D5DEB1trueMicrosoft WindowsValid 734700x8000000000000000245626Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.388{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\Wldap32.dll10.0.14393.3269 (rs1_release.190929-1234)Win32 LDAP API DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationWLDAP32.DLLMD5=12D6C3E8AC705BB42D377C05714F551C,SHA256=E67F6DB96F062A319312C365F1F55B2B38B0F90B77FFDA2522418709CBA45EB3,IMPHASH=D13722FCCB1CDD38974ADB7277D98799trueMicrosoft WindowsValid 734700x8000000000000000245625Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.388{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ole32.dll10.0.14393.4651 (rs1_release.210911-1554)Microsoft OLE for WindowsMicrosoft® Windows® Operating SystemMicrosoft CorporationOLE32.DLLMD5=3858DC319832992A738C12330E3E579C,SHA256=DEDE14211FCAE7CB5500730B35BABFEAC1F0D207A248D8B6418D2EEF8F348716,IMPHASH=9724475F92787AFC45A3BA458C0DCDC5trueMicrosoft WindowsValid 734700x8000000000000000245624Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.388{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32full.dll10.0.14393.4886 (rs1_release.220104-1735)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=17F9517D037D676FE11AE7B4F232CB0E,SHA256=9C9990CFCD1C66152D16037FD81FE2A202AA3B19D438121318A36887E282F76E,IMPHASH=059EB3BAA45E35C79FAE66F7279059EEtrueMicrosoft WindowsValid 734700x8000000000000000245623Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.388{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\adsldpc.dll10.0.14393.0 (rs1_release.160715-1616)ADs LDAP Provider C DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationadsldpcMD5=F03FD7F523CFDBB96B0F3B8012FC161D,SHA256=8218E5AC2D7A52A2D50CD8D3CC8AA8CE4E37D1BDECFA62BC2637AA32A01CBA54,IMPHASH=AFF2E9AF6DD20912DC1E604BDBCA3761trueMicrosoft WindowsValid 734700x8000000000000000245622Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.388{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\win32u.dll10.0.14393.0 (rs1_release.160715-1616)Win32uMicrosoft® Windows® Operating SystemMicrosoft CorporationWin32u.DLLMD5=6A40F9C63B52CB4E8271CF3418618033,SHA256=A2BE23DA7AADFA9118130C939CD59D86E590957172FF404511EE6C5EC5147F15,IMPHASH=00000000000000000000000000000000trueMicrosoft WindowsValid 734700x8000000000000000245621Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.388{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\gdi32.dll10.0.14393.4169 (rs1_release.210107-1130)GDI Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationgdi32MD5=551D603CEC947F586DB9FADEF4D2EBA6,SHA256=143125EFF9F3BC5B3F3BE505F3C3814393807B9CACB6AA5F75D39C77EC0D4ED8,IMPHASH=A24D446CB7FCBB6D29B592603C0BE00CtrueMicrosoft WindowsValid 734700x8000000000000000245620Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\user32.dll10.0.14393.4169 (rs1_release.210107-1130)Multi-User Windows USER API Client DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationuser32MD5=883B59C5557E8A9B3C1E1ED1CA48CD5A,SHA256=271800C20A96587265BF83DE2EFC11329EEB2B6C0D57E5E0BCD137FB96BFE6E3,IMPHASH=070F257E4632BC576557C4085595EAA4trueMicrosoft WindowsValid 734700x8000000000000000245619Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\vcruntime140.dll14.16.27012.6 built by: vcwrkspcMicrosoft® C Runtime LibraryMicrosoft® Visual Studio® 2017Microsoft Corporationvcruntime140.dllMD5=0C583614EB8FFB4C8C2D9E9880220F1D,SHA256=6CADB4FEF773C23B511ACC8B715A084815C6E41DD8C694BC70090A97B3B03FB9,IMPHASH=2CB5DA5225E972A08F32D04B8085DC7EtrueMicrosoft CorporationValid 734700x8000000000000000245618Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ws2_32.dll10.0.14393.3241 (rs1_release_inmarket.190910-1801)Windows Socket 2.0 32-Bit DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationws2_32.dllMD5=06E82905620845A7C185BDEE85CC4140,SHA256=B75C9B080293F85568912BABE749F403144959206F9C6BAB36B628E8F77C5DA0,IMPHASH=76A5AA3DF6083D853F576403C8F841A8trueMicrosoft WindowsValid 734700x8000000000000000245617Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\archive.dll-----MD5=AD564ED89D67D88709AA5980BAE20604,SHA256=0EEBE5AA750667908006742E133AE1C273D966897B95B1A0E63826450BB4780A,IMPHASH=A48DFE6DD98128BE3EB687CBF2724A44trueSplunk, Inc.Valid 734700x8000000000000000245616Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\rpcrt4.dll10.0.14393.5006 (rs1_release.220301-1704)Remote Procedure Call RuntimeMicrosoft® Windows® Operating SystemMicrosoft Corporationrpcrt4.dllMD5=15F8A053D1C107CE7541C176245D41F2,SHA256=57C20DA6894F71C7252D71CC40FFADAAD6FA47CBC0EFA6C6F85F899F5E72C9A9,IMPHASH=154EA5DE40F0F2475E943DE8013E5692trueMicrosoft WindowsValid 734700x8000000000000000245615Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libeay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/libeay32.dllMD5=B28B29D2F85EB8349BFB5E7214D7F4D5,SHA256=17260ACBE55D8988E598ECEFBC60140EBE057336B47D8089444588321F067280,IMPHASH=838F909F0A52D977E0B8662364FA0BFEtrueSplunk, Inc.Valid 734700x8000000000000000245614Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec.dll-----MD5=9BC99DECE580BD163AC318FCD1ACB667,SHA256=94BA08021E14476ED8EC2DC81165574B64274E20F2D8DE9CA98CD0D10CE279F7,IMPHASH=3295DC2518E43BEF226F8847873D20C2trueSplunk, Inc.Valid 734700x8000000000000000245613Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxmlsec-openssl.dll-----MD5=98C643DECFE1971BE3E8B076B19BFD72,SHA256=A520C20F316C902985449BC17AB5F86FCF2F41420B08C1AE08BA06E767EB49F3,IMPHASH=464BF3FDF330E6A15D24CC679EF7F72EtrueSplunk, Inc.Valid 734700x8000000000000000245612Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\sechost.dll10.0.14393.5006 (rs1_release.220301-1704)Host for SCM/SDDL/LSA Lookup APIsMicrosoft® Windows® Operating SystemMicrosoft Corporationsechost.dllMD5=9F0F4C38A22FC9FFB8814F77A9563680,SHA256=E9ABDA1063716301F5D06DBC94D6A35B3F53A14B946525E5F764485132DB6166,IMPHASH=D6E06125849E8565A50F366A0149FB40trueMicrosoft WindowsValid 734700x8000000000000000245611Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.387{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\ssleay32.dll1.0.2zaOpenSSL Shared LibraryThe OpenSSL ToolkitThe OpenSSL Project, http://www.openssl.org/ssleay32.dllMD5=0FE6D3D4B3F4B0F5502371832D12BB8E,SHA256=3DF79909021C72E70D2AE273587296E5E2D5F77315011B5C3115CFA359682647,IMPHASH=E09B42A7EA1725DA2CD99223AD969C63trueSplunk, Inc.Valid 734700x8000000000000000245610Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.386{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\ucrtbase.dll10.0.14393.3659 (rs1_release_1.200410-1813)Microsoft® C Runtime LibraryMicrosoft® Windows® Operating SystemMicrosoft Corporationucrtbase.dllMD5=9804D130E8E7178738C2B9808091B427,SHA256=6053B7CC85846F15094475116A8C57BA89FE99FDD1978C54E8A7E2114E318FE3,IMPHASH=57ABD1FDE351971A01E912069E11B44CtrueMicrosoft WindowsValid 734700x8000000000000000245609Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.386{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\msvcrt.dll7.0.14393.2457 (rs1_release_inmarket.180822-1743)Windows NT CRT DLLMicrosoft® Windows® Operating SystemMicrosoft Corporationmsvcrt.dllMD5=0AF8989DD67A135B536CF948E3EFB7EB,SHA256=C693DA0EF4DCF3BC244661B9FD280FE12C3053FDD7B977712C0CF210831B2EF4,IMPHASH=07D6F84E3C8FD0D2C32F9398A0369BAFtrueMicrosoft WindowsValid 734700x8000000000000000245608Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.386{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\activeds.dll10.0.14393.4169 (rs1_release.210107-1130)ADs Router Layer DLLMicrosoft® Windows® Operating SystemMicrosoft CorporationADsMD5=C62947CD1080E3B128B517AE91B22D6D,SHA256=6BB5D8967F822B5B1646DC9069212914D36C4D3D65E086AC0890B6A02112B438,IMPHASH=C7DF3F2CF025F0BEDA797705E4F4AFBBtrueMicrosoft WindowsValid 734700x8000000000000000245607Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.386{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxslt.dll-----MD5=FBA0D04D5A8AEA25D86EC623A14D0056,SHA256=D64FE508393C40160D1EFB22149C69763CBAA921BD1BC74C8D4AE59A10C3B767,IMPHASH=987AB6B8B03EE421D8CC59EAFE452916trueSplunk, Inc.Valid 734700x8000000000000000245606Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.386{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Program Files\SplunkUniversalForwarder\bin\libxml2.dll2.9.10libxml2 librarylibxml2-libxml2.dllMD5=20596DB2126E9F188727597F0FCC7CDB,SHA256=BAD6246A2B43B07FE80643DE40B0CE49751C8E0B95B076AD94E59F16CE8D8C0C,IMPHASH=6DA659461618DB73B9BD17D114677D20trueSplunk, Inc.Valid 734700x8000000000000000245605Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-2022-04-20 15:22:32.386{8D845A55-2538-6260-0103-000000004402}2808C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exeC:\Windows\System32\advapi32.dll10.0.14393.4886 (rs1_release.220104-1735)Advanced Windows 32 Base APIMicrosoft® Windows® Operating SystemMicrosoft Corporationadvapi32.dllMD5=C42106182CCA611F629E46981D1A0EEA,SHA256=68C134F95A8D38AE84545C8D581F4BF808B6C9D97513EA3CABF019C66419CBAE,IMPHASH=B511E4B82A44D3731CDA46A74F5D57EAtrueMicrosoft WindowsValid 10341000x8000000000000000245604Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-355.attackrange.local-