23542300x800000000000000098194Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.963{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7898E26DB561F9ADECCDB38954076535,SHA256=EAE887767F0CBC46C46223BA54E7C95FECC08C1B83C89BE43061F84FA4568BDC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156384Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:52.166{27B03E6B-D3A9-60B9-0D00-00000000C501}8965600C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1600-00000000C501}1212C:\Windows\system32\svchost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+b157|c:\windows\system32\rpcss.dll+7897|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156383Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:52.057{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88B85AD87015ACEC0D0B276E4FDF69CC,SHA256=05BE321A0BBA8D544F4F0BBA8E72134A073C16C30607F527A1AA1DF694E25EBA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098193Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.478{38D812B3-DB20-60B9-7401-00000000C601}33682004C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098192Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB20-60B9-7401-00000000C601}3368C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098191Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098190Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098189Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098188Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098187Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098186Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098185Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098184Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098183Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098182Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DB20-60B9-7401-00000000C601}3368C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098181Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.322{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB20-60B9-7401-00000000C601}3368C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098180Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.323{38D812B3-DB20-60B9-7401-00000000C601}3368C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098179Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:52.259{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4B28861B39DFCA74023CB43A6222D025,SHA256=2D88D92D0254788CCC2331271FCF6873EA1E265148C4FB9E4FB38B247CC67239,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098195Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:53.344{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=170EE7BF09575FB61FAE7F31B350A3E5,SHA256=052CA06267687873DB01B236E1D6527719703841180DB6966C70266A4708991B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156385Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:53.060{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8AF98EA7D931CB3C9FFBB36A2764A4E9,SHA256=50E4208564A87600ABC25E1BEF5C42CAFBCB9D01F7FE9EC3199CB21FCBA518DB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156386Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:54.091{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9DFE122448E174D8880E865BEC0365F4,SHA256=F0A32BE0C88EE28F3DD60E6AF4C9D07CD7CCDBC52A613850684026B7600BBF8F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098210Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:51.353{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50136-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098209Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.048{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39C6C2B152859A2B57E35414CFDE1E36,SHA256=7352DB7965954720FBC9EB5202AE1978E35E2B4006AC09D089B7DFEF188BDA5F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098208Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB22-60B9-7501-00000000C601}3420C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098207Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098206Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098205Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098204Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098203Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098202Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098201Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098200Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098199Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098198Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DB22-60B9-7501-00000000C601}3420C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098197Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.032{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB22-60B9-7501-00000000C601}3420C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098196Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:54.033{38D812B3-DB22-60B9-7501-00000000C601}3420C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x8000000000000000156388Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:53.463{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57955-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156387Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:55.263{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A293962BC347702C86BDE5C7F0CF458F,SHA256=72359E5B4310A7616537397F93173F4FDFDC329718715D960610973C6ACFCDAD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098212Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:55.173{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7989E96EAF6E71B58D69CF93E146A2D6,SHA256=4542D445CD9D4E351E9BA445EF1EE7E1D608A65EA70BE003E317D1D1A44AA7E8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098211Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:55.063{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=154A6960063F35A612D897A932A6D1B7,SHA256=310FC47EC5D5023A3B4F815F0FFE67E59CCADDF270095EA92952130F1B54AFBA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156389Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:56.263{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E33A6FC8C5365E0CF8FD935276810A7,SHA256=0FD8EE78F69A16A687BF0715A0D194B3B96ED61377ABB0CDFEB92278EB94CCF2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098213Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:56.064{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=87B97059E880A961C2CC2CA6CA8A2B5B,SHA256=CB5EAAA141278BB31D92F35927C07F2BA6A7B6DBF67360128097423560A34EF1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156390Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:57.294{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D9318E11E338EE4BEA97543FF06C0A88,SHA256=EB6F03B8F66C9416F9764032B712AE4106819083C6807895F16C02FFEBA5670E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098214Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:57.298{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6D7ADBF16A84E9BDA157BB9896996AAF,SHA256=23CF61883AC6C2E865C2A1B4C88BFBE0BBCBD17F53F17AAFFDB86A9BFBBB1527,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156391Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:58.294{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=716C63713620F8BC58B0CEF886E7D64D,SHA256=2F5D528DAA0708147A2CDEE380DEC1BB59E2AAD0D88AC92976F4B68221D7AD14,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098215Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:58.345{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E9D56BF43A3BFA1CA37F909ACCC2FD1,SHA256=1084D7F620D4B233261CFB397323C8AB4E9F6DB0F2F35ADE9982D24AFAB74AC8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156392Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:59.529{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=888290AE4131A01DDE24F3A32539771D,SHA256=370FBD2143D130BE22789B268170F8CFA0581C815CF5A40656389646F4CEDDC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098216Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:59.377{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=988E5E3474083E757EC418DFF5A3E48F,SHA256=BEF02573804D6E835813FC0AE5D19A7DDC3D15C5D24AD0AEB3F88E58819024DE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156393Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:00.560{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=049FD614704941F0240AD9D37F54C4F0,SHA256=685F350F7FC5A39E22DFCD813CFE2082318BA0F5C3ABC1354B603A015F390CEE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098218Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:49:57.360{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50137-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098217Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:00.393{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=799495BF46CD10F3B636AA50AB99860C,SHA256=C340E6A76C4E41407A7484B84A7249DF48D86C00AD8C783DD9C87E0E122EBD74,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156395Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:49:58.635{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57956-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156394Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:01.560{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=525FB3D2960090C552491D08775E515D,SHA256=581F5222708A4F5072D9B4104E604D4C5EB9B343BE60072FC80AF8CF4922DE8C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098219Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:01.393{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB276FAC7331DBFE9D39D06022DD7D76,SHA256=3AC2CCCD2C3F7819325759072BB5C475FF5079F2EBBDFF64B5005689559566DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156396Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:02.638{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CDEA0FC8BC75B4D00B1364E88605DA7E,SHA256=30B521FA7361D0D193545C021EB52B347760EE2CEC93E1F6E4E23A3501B8D147,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098220Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:02.409{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6AD2A1AF7007B5D1AA9688FA77233D29,SHA256=CE9E5202DBF1BCA7372EF3C9CBA22401B3CA8E5289BCCF573BA35BBD2B6B47EC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156398Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:03.638{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A79CB597487AD501129772B8196AF0D4,SHA256=894621243CB230F0C163FC52146052E0E3C6D6E7D24DCC93345EAC6872FE0A56,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098221Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:03.409{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DAB5E1C09D2DE94FDDFAAB37F07E9E8A,SHA256=0BE487E2EE756495C77C80519A989A6994FC1880C56CF1B384A05BFDD0A93965,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156397Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:03.185{27B03E6B-D3AA-60B9-1100-00000000C501}380NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=9BC3DB81E833F6696A049B826D07C248,SHA256=55D23998E269CC80982EC27ADD209173EB8571DB680FE126A339E93F26E735FE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156399Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:04.685{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F96BA376984FDE271CF254D44F59283,SHA256=D224A9B827E3B44653AEC2070A0E60E4CBDB075B777F845EE2CAFDF3FFA194C0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098222Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:04.425{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2027EA5A1319F80181B7563874351A3E,SHA256=4815130680A55157C0724D9C6E16213151163E83B571AD38E50953F0D5417664,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156400Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:05.841{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=24CE89AADBC7B2632CEAD4C4768659B2,SHA256=DBD594B737A11F64265B55C2F66E6A3F3E1E187F8E925892FD83AE9FA07EDB06,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098223Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:05.425{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D09E8EDA58F5E9C01BFF669E0122C4E3,SHA256=B5A4752777F49EAE73D4B3454DB41DD557EB058077206D6BECB28A22ADA97A53,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156402Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:06.842{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E62B4661B4A39DAF728636CC3462E814,SHA256=55D9EBB7E81A31FA2188751028EF62AB8BBCE82DD9FED377EF9CA937D430D70E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098227Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:06.925{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=D0F20F3CA46C4A81124352A2B486D4AD,SHA256=974C96C08F3A4E64970171C420E2E41712AD7F61A48F46DF8A1194B17024DECA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098226Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:06.925{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=C16358BF5027D4DC7CA666CE884C27BB,SHA256=E719A28C1D8AF477865DC24C9074D2CD0C309608FA4D0462882A5FFC9C1778F5,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098225Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:03.344{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50138-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098224Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:06.441{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9AACF1C0A350D98EB8940A0A0A475A2B,SHA256=E77001107E7F51368624DD27C22120514C6FC789C5900E80AD2E8B2E9C3B4A2B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156401Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:06.092{27B03E6B-D3BA-60B9-2A00-00000000C501}2856NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156403Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:07.842{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8042BFA1B740E876CE45AB4A3EC62680,SHA256=27D641155EA8795BC2831A7B646010DDA515008E44079191F7CA3EC6BFFC7808,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098228Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:07.446{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2FB4F54362D969CF861B174D3BED5E8,SHA256=A0B93F807AE0B17DF9915A9C8326F54A20A8CA5B6046A8BBA2047B2DE5469CAE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156406Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:08.842{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89AD9DFE702C7B2F54E5DB2676A296B8,SHA256=EBDA71506D4AD75455DD60E76B89ADA3E413D593AC79A3DB00A11F43DC7DE57D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098229Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:08.459{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=74F25F3317CBF677B2E0E8BA46E0FEF3,SHA256=F00E59A631CA02DFDFA4F8CE2E1C62D85F45E795E1C19098C1844D9F59D607BE,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156405Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:05.479{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57958-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 354300x8000000000000000156404Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:04.635{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57957-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156407Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:09.842{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED62FA96FA4AA90CCB94D5857FE50483,SHA256=A2982BC6125D9C853E0FA26D3E7E05B49C50C537AEBB97159F1919271F5AACEC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098230Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:09.462{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8215525E5C5C44F4A0237D5B18096AE,SHA256=E5BE8E3D432974FFC0370281A38C7BED6292B054BBA64F3E2084898B77B8A69B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156408Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:10.857{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=015784F2E86B0F0762357B1AA6864E3B,SHA256=BE90D433F96703433BB1EECBDB99C2779A74D86C058EEDB548F7EBF30B89A988,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098231Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:10.462{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80FABD5CE77E9587BD04221E80CA6BA2,SHA256=14BDC1DE0BB17B0EF1BB66AAB6F062035F470718CE7C89D78D313CB6B9899C69,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156409Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:11.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC1D023708E2EDC45E67D0F46E0D282A,SHA256=57640C9E1C83392FF1551A9FED5AA817A7034DC568617073640CA3C01ABCFA65,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098232Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:11.462{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1D15E3D83CDF263F6C5ECD1F171050E4,SHA256=4568A15D0EA575A1ACD288FB0741D5A7E3698E4B9C5092BC03FA494E6E96DDAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156410Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:12.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17997F92A1E37379A497DC3B3C2D80A8,SHA256=ED8495F9FB0E861FE8C422908E9C7307004F3EE1004D10E90169495F8FBA1B2F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098234Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:12.478{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8188186C0AA20181F431F9A7730ACD6B,SHA256=652020F8BB6EA594556AD0DF43F51541D85B7314C3D61AC904E9B06A88B8E838,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098233Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:09.318{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50139-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156412Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:13.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DF81EEB5ABC88B6E2A0B26DB65211452,SHA256=22FE8130C0E67C149E9A19007951CC172E383F4E51145B9164DFC41BE79A349F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098235Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:13.485{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2552E536FA048CD834E919D2349BE44,SHA256=AC42AB1FFA54E8147B8B6B85FA1FB222E77826FAB114D1906ECD953C05474278,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156411Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:10.620{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57959-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156413Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:14.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1880060953465975BEF3BAD3829C660E,SHA256=FC354427E8E0164C9CF56164CDF240BD599147A2653B1A469663A834207A1E44,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098236Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:14.485{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=18B9E34974F1284DE278D62FEBE820F6,SHA256=DF6F9B386B218B3CCF0D09EF7B2A1F100E360D3CB4C20ADAF95C25A92E0B26DC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156414Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:15.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBBE9591763958F00AB55E1E72709D29,SHA256=08FD357BED1452D8C21B025748CA54A73E74ECBFF3A974B837E20AD760BEEB13,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098237Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:15.501{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FC98998B5FC09E8205D958AAECEE6C22,SHA256=38DA325137D2570FBB2DC6235FAEE94035883E795D22D3C1A8E77D1E05D70A30,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156415Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:16.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0B7503F8F2DC35678AE866EAA9F0E39D,SHA256=E566AC8CD5BDDE59633FE127E8D1264634AFD0CE6B9BB9F404B777FB55F4DB48,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098238Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:16.517{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CEA2ADE2156B78A04FEC5490A9F18E64,SHA256=AFEE4B70C27FF74813654773AA39FC60EC4E882AECD39E9EFC81227915E1FA73,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156416Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:17.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2BBD010D6F3F68B19BCFF88E2BFCC83,SHA256=A564B961C631DC70DE067468F3B19B35FB38D0F89B3429A734679AC5D9953BB2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098239Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:17.517{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D20061FFC629CCB62466FDEBBA1E94F,SHA256=1BEAD28F61BD40AEECCFD756C6B4C23154825C9CFD8B6451011C2E5647928268,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156418Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:18.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FCE8F71661924A89DBC53A11F10D950A,SHA256=B156518D4F88686EB1FEA3D2D52A39DFCBF329B5E08E368190396633F87DDCCD,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098241Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:15.294{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50140-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098240Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:18.533{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3C8A3844AED3DE4416A963FAE4645C5,SHA256=FE113B10130E4159E071F4CF70ABA40C906C6D98E10E29F4343EE4346B3A718D,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156417Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:16.510{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57960-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156419Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:19.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B416A3726064EB0A7BD3D71A071A697C,SHA256=4453F01A7BC56A93727AE9DEAB67CEE081613687AAE25A7441863808D7D4F7B6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098242Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:19.549{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=50247C7F956A351443BFA2BB61274AAF,SHA256=25E4D22A9CAB90980B26ECA3639EE09B5F06CE0D47B907E6C0E13074A4A7CED6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156420Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:20.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EB01890163AC53A06EECF52E08CC221A,SHA256=F0001C71DBAA1CC58CE48C5F585FB710154D3B95C84DB025BD85C168FD861E8B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098243Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:20.549{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=54EF80F99809A66F3B862ADDFE046FC8,SHA256=65A3172D2215AFF4B1155DB18DB4A93082569A27D1CB33A131C76786E12F70A1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156421Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:21.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C51E03C0230E57D726AD9502E03C23F3,SHA256=6E274A1F7AD0246630CA0D174CAE58CC466014E90FA11556018A77923F0BF80C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098244Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:21.565{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E91FDA6814C499E75A5094CE6480AA7F,SHA256=4D0FBB8844A04D927E9A0594C7B3B76CB78FEA70D3E6DF3FC84ADF208F79DB13,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156425Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:22.873{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4FDC21A678A2668B1BED431D4CABAE6,SHA256=7D64AC0F2A4F7C917F41DBC589547C92B7042D8780991733D76648E88235E6CB,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098247Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:20.294{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50141-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098246Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:22.565{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A70E6E82B8160426E3D00700352C656F,SHA256=3C165D89754DCDC5C82F301C32BE7FB0EB8E8B64F02F36126F11DF7BB7BE2234,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156424Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:22.061{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1500-00000000C501}1204C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156423Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:22.061{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1500-00000000C501}1204C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156422Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:22.061{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1500-00000000C501}1204C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098245Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:22.096{38D812B3-D3CB-60B9-1C00-00000000C601}1936NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156427Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:23.889{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=60C278D03FF8DC37BAF8FEBD9DAA65AB,SHA256=6BDB9F17BC8C4335E539B72C4A9BCE0981B77733E695CBC3871B8BB9A6887A1D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098248Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:23.565{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B9902BDBA7011B7026D3A6402EAB2A8,SHA256=DA84589BB163049F70F5DBBC1EBE9227D128D8388932484481CD028D5770A71C,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156426Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:21.651{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57961-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156428Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:24.889{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=34E5E965353D319E0BC7DC1C47A9BAAB,SHA256=97A4940CE9E2E655D65AA3E915C191806BD5EFE45B30D22520E80F6618B99BA5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098250Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:24.581{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71D03AA0733DD47B97E65FBE12FF564E,SHA256=57CC8A8900DA5CC635663F33043078AE1AB92B953DE64F45217E9C1DFAE3FD61,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098249Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:21.341{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50142-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x8000000000000000156429Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:25.889{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=26195184A9EECEE078431959B4A5CBC5,SHA256=426C01C60A54D569AEE51E50FC7967A121D2443DDA331EB9C331B2EA7CF05CC0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098251Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:25.581{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5B22E2DED27A2B03E78141F8DEB967E6,SHA256=E8DF193BF56E5E4A12E4F9FDF64058E8BF6F5DB9F70E246C4B98A6A680BADF93,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156430Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:26.889{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=260295A3C2EDBB697F9DABA9ABAD66EB,SHA256=658DC22A1EA450F51D99164E28CE80DBC4D1760065135BE8D5E0E836912EAF72,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098252Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:26.597{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8BA760915BE5687F9B7CA4F6888804AE,SHA256=CC2B56E2C8CB957DE5694F2C2DCCC16D5D38D738E3AFA2EE31279493FEB8A0F5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156433Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:27.905{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4AEF335DA6C1073C78452BE5CE743810,SHA256=A4C02F0C12F006231E17D2B13E384559A795F130521EE52EB0735053EEE4986F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098254Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:25.434{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50143-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098253Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:27.597{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=012EDA852AB1F22D7605DC30BC0C8368,SHA256=F94B259AD92380A005C3BA9150D500F821F707036B50983D22AA6BC67A30B809,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156432Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:27.186{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A797919641571DB82219940A516FD33F,SHA256=1491DCBF41A3BF1F12751C69EFB9A563544685183602C0EE4B4EFFABA26CA659,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156431Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:27.186{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=F43BFABAA1955AA91AB4F38DD1BDED58,SHA256=1F865909CCEDA68BD1F5FB34C076766A6D62866E1426169A859A6BAE5EFCED52,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156434Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:28.905{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0439F93DDDC61589D5FBB336DBCA221A,SHA256=E74876E4CB7677295448A82E178C737996C46DEA347BF010E0C00F0A282CCD35,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098255Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:28.613{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63AA85BBFBE3C36C57C1FFD03179D13B,SHA256=8168F24C187F0EE9E1B0CF0D2A5F3C64E4DDEAE0063951643F96FD65E1BBA8CC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156436Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:29.905{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B4A1A08706B806D5A03251C6BA21221,SHA256=7F0AF59C0BE7730564117192EDA6DE3BE7788D55712A1B185289A2C935E47B2D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098256Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:29.629{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CBBAC96855888D16FA93A74B3FF6F9D1,SHA256=622DA2ED50A58AB0EA87DD95B2404A5F3355677D4839F5E3C89346268A46C5CF,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156435Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:27.573{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57962-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156437Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:30.905{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=35A392CA8B0D1B5176D4678CA8A852B8,SHA256=3CB8695E1BABD8676731C2420EC8E7EA5F4320FBD80E488C4658596FE5D473AB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098257Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:30.629{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=17F34B74CDB629108E19AA43E44975C1,SHA256=B0D569A54FE8541F5D0F54958D1D0F21A73D1273EEF1F8731EBE0135DA959BFA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156446Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.905{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD638C0F078B84C1E2660FEC9929A9A4,SHA256=9829163EB1386EF522281C61AC29D54132ACCCBFB0F4628A8A8FC600138056AE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098258Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:31.629{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1C56D62A548A6A681202A9B7D0B3DBF,SHA256=5183726A4260749567A791AE9DD18BB7C96DD4CE0EEA436733552623B4EA6DB2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156445Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.795{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB47-60B9-9701-00000000C501}4104C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156444Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.795{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156443Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.795{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156442Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.795{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156441Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.795{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156440Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.795{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DB47-60B9-9701-00000000C501}4104C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156439Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.795{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB47-60B9-9701-00000000C501}4104C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156438Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.796{27B03E6B-DB47-60B9-9701-00000000C501}4104C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156457Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.921{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B47DC4F8A87229ACB381C5EF7E97D6A5,SHA256=24C0B166A79302B622072627A55043E2845BE3365773EC7296D77141FF92C690,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098259Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:32.645{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F14451965920A11C17286DD89034197,SHA256=EFE09FF72326D63B1F6C28165D408FF0176901FF2DA6004854AFF0BDD5730ECD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156456Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.874{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4169AF7625B77E3B4EFDA5545D15985A,SHA256=9C2591F36D3B5B6E53908ABE3991C993FD684D6DEA70A03D3F3FF853EFD91070,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156455Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.874{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A797919641571DB82219940A516FD33F,SHA256=1491DCBF41A3BF1F12751C69EFB9A563544685183602C0EE4B4EFFABA26CA659,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156454Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.858{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB48-60B9-9801-00000000C501}5088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156453Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.858{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156452Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.858{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156451Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.858{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156450Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.858{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156449Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.858{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DB48-60B9-9801-00000000C501}5088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156448Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.858{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB48-60B9-9801-00000000C501}5088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156447Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:32.859{27B03E6B-DB48-60B9-9801-00000000C501}5088C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156469Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.936{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9BA790065D0BB184B067B6739664E161,SHA256=4CEF8EAAE76BC0480686A2585D2C23FE0018F6303444879A7A8E03248FCB2EE3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098261Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:33.647{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8494953371D598680B767020E52794D8,SHA256=E840F845643CF07F3306D043FC613D5A7500AF7C956AE3B051CC522C45E72D21,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156468Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.839{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local57963-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 354300x8000000000000000156467Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:31.839{27B03E6B-D3BA-60B9-2600-00000000C501}2784C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local57963-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 10341000x8000000000000000156466Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.530{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB49-60B9-9901-00000000C501}4748C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156465Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.530{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156464Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.530{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156463Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.530{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156462Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.530{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156461Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.530{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DB49-60B9-9901-00000000C501}4748C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156460Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.530{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB49-60B9-9901-00000000C501}4748C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156459Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.531{27B03E6B-DB49-60B9-9901-00000000C501}4748C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000156458Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.030{27B03E6B-DB48-60B9-9801-00000000C501}50884816C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x800000000000000098260Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:30.434{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50144-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156471Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:34.952{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=851301B9E3FC4BEEB0190BC5F16785AC,SHA256=1BA9F1AC543F7AA1E045344C4FA4216DDB78C94BF6CF61A890317A7AC4C5F82F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098262Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:34.647{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=809FBF60201A87CAFEE32C620D5ED68F,SHA256=E100808003B6C41A4658325B2BC518737B43BA502A61067DB8F37A77FEAD6D01,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156470Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:34.639{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4169AF7625B77E3B4EFDA5545D15985A,SHA256=9C2591F36D3B5B6E53908ABE3991C993FD684D6DEA70A03D3F3FF853EFD91070,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156490Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.967{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB4B-60B9-9B01-00000000C501}5764C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156489Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.967{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156488Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.967{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156487Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.967{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156486Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.967{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156485Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.967{27B03E6B-D3A7-60B9-0500-00000000C501}4202108C:\Windows\system32\csrss.exe{27B03E6B-DB4B-60B9-9B01-00000000C501}5764C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156484Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.967{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB4B-60B9-9B01-00000000C501}5764C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156483Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.968{27B03E6B-DB4B-60B9-9B01-00000000C501}5764C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156482Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.952{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BECFED830E1886D015B4CB1640B4F2F9,SHA256=CD89C81637AF88EB5B41BA20D775AB0C5FDF81CD6957A9A75B3808664F6B9072,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098264Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:35.647{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BEE36EDDC0E7B8B75A5024AC78F8BCD,SHA256=18BAF7D5A7C4B4C134E917BACA92EF4A21110D54D8DB13D1250D68264A73F5A3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156481Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.702{27B03E6B-DB4B-60B9-9A01-00000000C501}13804344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x8000000000000000156480Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:33.479{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57964-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000156479Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.467{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB4B-60B9-9A01-00000000C501}1380C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156478Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.467{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156477Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.467{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156476Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.467{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156475Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.467{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156474Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.467{27B03E6B-D3A7-60B9-0500-00000000C501}4202108C:\Windows\system32\csrss.exe{27B03E6B-DB4B-60B9-9A01-00000000C501}1380C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156473Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.467{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB4B-60B9-9A01-00000000C501}1380C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156472Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:35.468{27B03E6B-DB4B-60B9-9A01-00000000C501}1380C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098263Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:35.631{38D812B3-D3CA-60B9-1300-00000000C601}96NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=D2F68744EC82FC18AC3AEABE370D7671,SHA256=646194BBA2824ADB23BD934BA71B7CFA6D3764FE81950F9E8747208A03287566,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156502Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.952{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3F644F0236DB37599817E5CE1A7F0C9,SHA256=FEF6C4E096AC26793C3D2C2060C4C022443BF77752B9C99FC9A8C44BF7E0C718,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098265Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:36.647{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B26564DEAE5414DA64785CEE2854E552,SHA256=16C05CEC540F2DD825A2B8EE38CA69E2D02E8A19A67E17F950536CB41544F8CE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156501Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.811{27B03E6B-DB4C-60B9-9C01-00000000C501}42165772C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156500Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.686{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A27C4D60AC168ABD9202C19AE402E4CC,SHA256=14D3B494DD2963941775F51A81B81C0FDFD4BCFE69E2736E8594952D74D35750,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156499Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.639{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB4C-60B9-9C01-00000000C501}4216C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156498Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.639{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156497Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.639{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156496Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.639{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156495Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.639{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156494Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.639{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DB4C-60B9-9C01-00000000C501}4216C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156493Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.639{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB4C-60B9-9C01-00000000C501}4216C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156492Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.640{27B03E6B-DB4C-60B9-9C01-00000000C501}4216C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000156491Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:36.139{27B03E6B-DB4B-60B9-9B01-00000000C501}57643364C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156503Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:37.967{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53F7FC16F798196C0353F2DD34E22AE6,SHA256=4DE1A7DCB3831B5C544994A37DCEBDCD1E5D36B69E0DF6B04F84AD8E61B91936,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098266Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:37.663{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8DBD93A41112F3F272A5AD57645B3E7,SHA256=FA4FB04CC8288DA2351BD7B875555B9868E84F08287020476491C91A6D879C24,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156512Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.983{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB00DE55E857A8F74D130F008CFDC6EE,SHA256=67B3195B68CD981E369D754B92C8B459C6D27ABDE2604134FC001677B3807990,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098270Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:38.679{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98267627283AC8C019E651614E4A53D7,SHA256=2CE6A979E99715FC880FCA0BE246DD5D22DF36926B958ADC8E5AF4281A80B948,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156511Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.467{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB4E-60B9-9D01-00000000C501}2712C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156510Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.467{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156509Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.467{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156508Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.467{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156507Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.467{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156506Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.467{27B03E6B-D3A7-60B9-0500-00000000C501}4202108C:\Windows\system32\csrss.exe{27B03E6B-DB4E-60B9-9D01-00000000C501}2712C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156505Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.467{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB4E-60B9-9D01-00000000C501}2712C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156504Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.468{27B03E6B-DB4E-60B9-9D01-00000000C501}2712C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000098269Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:38.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CA-60B9-1600-00000000C601}1220C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098268Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:38.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CA-60B9-1600-00000000C601}1220C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098267Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:38.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CA-60B9-1600-00000000C601}1220C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156514Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:39.983{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56272A381CCADBE2F9D2DD3003DA64AA,SHA256=E641FC2CC73BEE5D7F3F040C5590596AD3EBA8059EB7ED4140B6218532B37500,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098272Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:36.420{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50145-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098271Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:39.679{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=228A50C9CB825F810AC7E165D8E62E2B,SHA256=2CCAF809E4358B0378CAEC1630A91E300C5D232D6B52C6D64E5BFAB50AC2BD9A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156513Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:39.530{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=DA59B011ECEF851195B73E4939EA7356,SHA256=F0BE7DE0A679FB613DB2AAA180EF4264EDBB9AC5FA81CD6D82B7C68C7996FFAD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098273Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:40.679{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E8BEA8BB47E9ABEEB78A092DE28893F6,SHA256=B2AB8ADB1DC61594617CE031293FFACDF04E788BF7D0724D13ED8F8BD06A5291,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098274Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:41.679{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B5CA98AD9424199CF297EFDC8007248,SHA256=0BF006D088000367172FE2D0E31B7EEA9750D0045CB6DAADFAE1BDFC7A86838C,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156516Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:38.651{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57965-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156515Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:40.999{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B7D30EE13CB7C0EFD76BAEC88AD35FC,SHA256=EC58C2C9520F5C43E016F3EA427B2233F417ECEC473AB013F13B53C7B5DD2AD6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098275Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:42.695{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52D8AF40AD9FAB0CB90EB47466CDF7D6,SHA256=65B99D86D2E15BE39B5146AB5DFCC61C7D23377BC8BBA9CD1490413BC4144C76,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156517Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:42.233{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6718629B8BB97D826DD63398727C279D,SHA256=C0BE58FF2EBB64EAD8EE79C16384C6B9C60FD00FEC820D3D77C7E01D2E93967B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098276Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:43.711{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9493B032F27F4FFAE8BF0710C8CF53D0,SHA256=6DAFE94F5EFA35F4D1B7223AF5A2193D1C92E840D32675DB845765293C5FC5CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156518Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:43.233{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EECBA58B5B9770AC3E676DEB1BF2E09C,SHA256=15152473366C7C5F539FAD9E239F30EB292A60658E6BB19D85117C996BC2D730,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098277Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:44.727{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3E2C6D2E69E174DEB7F9767EDF7BABAC,SHA256=DAEEAA23A6B013EF8A68D1E83121D17731B1D2D26D2570BFD67605845D6EF0CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156519Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:44.233{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B673941B1D49A02459820045EFA1AB2E,SHA256=97C8C5158EF9604E7D905212D0EE0C5F13A127A84EA6FC00B5F5AD943D592EC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098279Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:45.743{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68D89A83BEA904C2A1C07EA16B6B23EF,SHA256=E13BA8042D62885F6A4B1A3E350A3872A0BF83FFD6636B0EBD79066C711BCB35,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156520Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:45.233{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A6CDA50354E9ECFE9361168A6EFFD39,SHA256=534DAF0A71CF651D76125A9B36E11978676CF94D9F44ACFB6A950656DE060FE3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098278Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:42.389{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50146-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098280Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:46.758{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51EA535909EDD70B27F65D3EABFA08A7,SHA256=6AF896947D5958E098EBC4AB2D57B625C3952673979BBB4B465DF9F371B2C77F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156522Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:44.589{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57966-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156521Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:46.468{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B2D5803C58FDFE9CE5F3409206D2549,SHA256=35999D09E40EB40911E481D980860B1AEDF9BB39955AEDB3C779EE1A3B2FDA50,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098294Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.759{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C0866ADCAAB0A8D5847A42FCBC1C1946,SHA256=75B8BFE3262FC46CFEEBFAD73BC0997B22893F47DF15DC6F7F5EB9673B1F443B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156523Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:47.468{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6700504F5B3EBEBCAF852ADBD3AEE58C,SHA256=EA2D379EB11D0BBB8415D14A6F5F2EEA63A5A314290E323F1090488F94022273,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098293Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB57-60B9-7601-00000000C601}2440C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098292Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098291Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098290Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098289Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098288Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098287Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098286Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098285Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098284Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098283Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DB57-60B9-7601-00000000C601}2440C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098282Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB57-60B9-7601-00000000C601}2440C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098281Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.634{38D812B3-DB57-60B9-7601-00000000C601}2440C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000098324Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB58-60B9-7801-00000000C601}3488C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098323Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098322Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098321Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098320Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098319Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098318Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098317Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098316Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098315Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098314Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DB58-60B9-7801-00000000C601}3488C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098313Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.774{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB58-60B9-7801-00000000C601}3488C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098312Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.776{38D812B3-DB58-60B9-7801-00000000C601}3488C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098311Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.759{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B4CD39309058A95858BE1518713586B3,SHA256=07BEE521713B3D0ABA58AC868CD30425887558749FE4F7708F91F74F5A28E690,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098310Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.759{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=51848A3B989A13F4DAA55223DB02F723,SHA256=43584927F2F1A1D34AA6C2420229175734BE3D8D571C86D1A740BF22AD258921,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098309Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.759{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9C6E36E556F7CD8A45C471F70FD0E09E,SHA256=1DB9A31163E8B1CE0560A2EAAFEB506FB83E29AF3C0B744885F3D647B77BECC5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156524Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:48.483{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=142CCBE6067AB4DAF9F294A5FF053FD8,SHA256=A8CD0827DC2AB82809C8777F009E5D22B66E988B90CEFFF94AD041E11FAD6B50,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098308Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.274{38D812B3-DB58-60B9-7701-00000000C601}6483240C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098307Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB58-60B9-7701-00000000C601}648C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098306Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098305Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098304Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098303Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098302Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098301Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098300Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098299Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098298Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098297Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DB58-60B9-7701-00000000C601}648C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098296Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.149{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB58-60B9-7701-00000000C601}648C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098295Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:48.151{38D812B3-DB58-60B9-7701-00000000C601}648C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098326Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:49.775{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=51848A3B989A13F4DAA55223DB02F723,SHA256=43584927F2F1A1D34AA6C2420229175734BE3D8D571C86D1A740BF22AD258921,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098325Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:49.759{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E62BB34AB889AA3E978562DFB5ECE07,SHA256=7967A29F03D61494381E428E82127B28561563376968CAABCC4BD76382CE2844,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156525Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:49.499{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B712E0C5F63238B4D98C1172E133DDAB,SHA256=5C490211431D1F838FF9C4F4A174A085D8F547068105C44B4A0A6C2C9035AC8C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098328Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:47.420{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50147-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098327Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:50.759{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EAA65F0E3CFB5AAF868A7FFD1CAF296,SHA256=822A23E830E732000347F171B365AE262317AC8D17A73E558CD11F84AD44DFF9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156526Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:50.515{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D9A0293D51267292BA1E0932C291D4AA,SHA256=CF94199CCAC8CBF6BE22F57B3AC0ADAEFF25C959D03B5922D2F3F7D66A74C1E9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098356Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.853{38D812B3-DB5B-60B9-7A01-00000000C601}36803136C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156527Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:51.533{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D6B26550359D5101DBA78529E58F803,SHA256=F9AB60A15D81BBACC5F4BF8EF8D59AD87FA9C60A84A932F4A0ACC8520AC200C8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098355Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB5B-60B9-7A01-00000000C601}3680C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098354Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098353Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098352Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098351Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098350Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098349Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098348Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098347Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098346Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098345Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DB5B-60B9-7A01-00000000C601}3680C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098344Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.728{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB5B-60B9-7A01-00000000C601}3680C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098343Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.729{38D812B3-DB5B-60B9-7A01-00000000C601}3680C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000098342Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.181{38D812B3-DB5B-60B9-7901-00000000C601}30603448C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098341Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB5B-60B9-7901-00000000C601}3060C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098340Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098339Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098338Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098337Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098336Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098335Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098334Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098333Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098332Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098331Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DB5B-60B9-7901-00000000C601}3060C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098330Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.056{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB5B-60B9-7901-00000000C601}3060C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098329Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:51.057{38D812B3-DB5B-60B9-7901-00000000C601}3060C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x8000000000000000156529Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:50.542{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57967-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156528Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:52.639{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99919FF978ADC11CF062CDC0E2FA3134,SHA256=555C953B65A56790C72CB897F6836C8B175EA5EAB3482F7756B0A4A0D24476F3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098372Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.416{38D812B3-DB5C-60B9-7B01-00000000C601}7321196C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098371Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB5C-60B9-7B01-00000000C601}732C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098370Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098369Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098368Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098367Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098366Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098365Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098364Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098363Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098362Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098361Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DB5C-60B9-7B01-00000000C601}732C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098360Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.291{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB5C-60B9-7B01-00000000C601}732C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098359Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.292{38D812B3-DB5C-60B9-7B01-00000000C601}732C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098358Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.275{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B595B7A66EBDDE6FFF4045022AAEB692,SHA256=C12E67C8675E20524C555168B47ACE77D7CEECA533E6686B719FE0C2B81D508B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098357Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:52.197{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=178C8EAEC2804F7C9C8EA8134DEBD748,SHA256=EA12530DC7C509CD5600CB501B944EB1D28C4D987C7288EC9978DF3F611DD10D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156530Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:53.658{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0DD312E667C2835B455375F8BA3FBF67,SHA256=3991E641F70A1CBB91023F5C9EA44287B49B03AE07F2ED19B1DF773BDBEC55B6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098374Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:53.515{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C0EC27B1FEE4288994FB138D0E0209D8,SHA256=207AFC0D016D1A909B1AAF435EFB5F72FA29D100129556330913AF132D4709D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098373Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:53.057{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=51E7BC9DC06BE8233D3162A5D1C406D6,SHA256=002A1A62B7F56D1A5605EB9585AE6035DF1860FE842521A25DC7ED76C0E3C8A5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156531Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:54.658{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=83F24EDF6423D83D6A9AF2454C597FAE,SHA256=125544013D45A08C924BC2232E4A51C51D422ED1E7F1C6317D3539B59FDB87CC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098388Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.296{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A860DFF5E67B3056221CD2549BA9A908,SHA256=F01AD863A6E285C362D1F2A413BF13030AC7183B08EC54220903CAF4334F7129,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098387Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB5E-60B9-7C01-00000000C601}2480C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098386Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098385Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098384Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098383Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098382Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098381Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098380Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098379Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098378Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098377Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DB5E-60B9-7C01-00000000C601}2480C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098376Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.046{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB5E-60B9-7C01-00000000C601}2480C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098375Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:54.047{38D812B3-DB5E-60B9-7C01-00000000C601}2480C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156532Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:55.658{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=298DEF46E017E1CE38E4396140B67094,SHA256=F82BF098D329B84FE2DD445F7847C6EADE9AD2BA58E0DB6670CB6B64FAF86A7D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098391Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:53.347{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50148-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098390Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:55.499{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF2A9D8B8F67B313C737ADE379CF76B8,SHA256=9EAFAC18A80795C5C1E7580860FE36B0F0817130B0CB4D794EEE65EE3D26FA83,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098389Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:55.265{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=FF5B98CF95FFBA7F1E91CB549EE95FBC,SHA256=33FFAEA1D88AF88C01148F21608B0ADCFF87FA19CD7607AA727C663810AD961F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156533Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:56.673{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EEC320E7E04C4B242C01DC79914185FE,SHA256=7DBB441D09FC5E451555BCAACD972804AAB0954B5575C1D5433A97A4E4590B63,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098392Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:56.515{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B39262073EEC5A6F2A2891C556429874,SHA256=456705542526D882E5BFB8D95B02EF196E9E608DC2AEC0FE2B23D0960625A9F7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156534Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:57.689{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1E3847E3440854DABA984EEE3009BF64,SHA256=9CD0EAC3FE4001FA4F5DF14DA1DDEBFC37185769BF5DFED9504B908436498A2C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098393Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:57.531{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6C31DE27E9939DAE7E27245E81279DD,SHA256=3668E32172492E6FAA01A133DC5F5289C49436262ACD51216189949763442323,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156535Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:58.720{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BD9E224F22BFCD66720D171C413AB53F,SHA256=BAAA5788728759B72481A88F288C86948AC0AEDBDB5C067557B9B7AFB1C346A2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098394Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:58.641{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF70FFEC717A56132C000E4B753B65C1,SHA256=E1DA9579D52FC63B3154DA6CD329DC19675225A271BFD9C58B37EBF6B24AFB23,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156537Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:59.955{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A402026235B0AD958F18C7D62F6796E,SHA256=1F1E482B897C0FA569BF09954B68DA7C30FC0AEC4095D759F59B84EC8E17C33D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098395Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:59.813{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2757743AA7B8BF03B80A42C8A1533C97,SHA256=47A528A753F765FE73BF2DAB7BADD9E71951B93628E7021388310884F294CEFE,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156536Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:50:56.497{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57968-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156538Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:00.970{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=66173A495AED074E105B3F0D889F5677,SHA256=2C56B939E543C37992F66101953F617131A844086495F5E0A9BF64C0F4337801,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098396Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:00.829{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=564C35C7EAAC1C41EAA369D0B888C4C7,SHA256=F8737B0B5716A3C3792C90BD800DDD6C2DD7D9293882CFE2DF99E234DE938901,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098397Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:01.844{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DFD156FF2BEB9140D044A260152F4220,SHA256=3D2B1D12479E0AAB5184FEEBA581E2B61A379CE09688EE6FFFDB1C6863CCCA8A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098399Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:02.860{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D36A862997F36F498ACC67D1395D660C,SHA256=FF1D4344B2F8196842B9D90ABC2BB632EA954520C67FC3B299E540E86D220A45,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156539Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:02.002{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1F85F0524298F27FF85103488B33DD1,SHA256=77D4F8C87B453DC19A9B990711F3B2A0E1EBF71FBDAD5BFE6237C33C2235C231,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098398Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:50:59.285{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50149-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098400Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:03.860{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=689AC0627C41E514B412E9CF810BFED9,SHA256=96C6664A2E489C03EB579A8FB93D4192F2802A1474AAF15FCD3D2C881B414757,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156541Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:03.189{27B03E6B-D3AA-60B9-1100-00000000C501}380NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=914845A10A603C5FA4A018C3235CA26B,SHA256=31B21F8695F4C594B86EF007E87CC90F6714828D9821ECE63225A26D2EEC9F95,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156540Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:03.017{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE579CB182F9DD549A0FDCD3091345AA,SHA256=9757C2EF96D63C01BD3F0CD8293880CB46DA6369ADF510C0AEF64642D666F135,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098401Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:04.876{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D03B9B586195A9BBBE81AD8DA8C4ADF6,SHA256=6B469D845A8CEF9F8B1700D9A7B16300D8944C386D7088599F10B842A5027486,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000156552Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x8000000000000000156551Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x001e5765) 13241300x8000000000000000156550Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7590d-0xfc9a7d07) 13241300x8000000000000000156549Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d75916-0x5e5ee507) 13241300x8000000000000000156548Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7591e-0xc0234d07) 13241300x8000000000000000156547Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x8000000000000000156546Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x001e5765) 13241300x8000000000000000156545Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7590d-0xfc9a7d07) 13241300x8000000000000000156544Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d75916-0x5e5ee507) 13241300x8000000000000000156543Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:51:04.346{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7591e-0xc0234d07) 23542300x8000000000000000156542Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:04.111{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=300A2B0CFF770A39EB14B32D0A97753D,SHA256=46563AB7727BD11B7BD106346874FB0909AEC6333DB8B58140E67EFD12A1B790,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098402Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:05.876{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F3B9214FB4607400CC3F52FEDC3BCF2F,SHA256=F4004E7B779D017309CBF0A00C0F9265C4736A7D28AA3098B2ABD82EE60D185A,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156554Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:02.450{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57969-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156553Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:05.111{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1514D7D4CC5834418EC49087623E5213,SHA256=DBF1C3A9924FFA39F70391BD023F9514352962C90EB3360B46F74302C6026DAE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098403Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:06.877{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3F652EB50B32AEEBD560C80CB971320,SHA256=3DB8F5C76E2C6BB60DF2469E2539C84656B6A9D3FB699198EE19BD150226C552,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156556Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:06.127{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD1379C1B878F5302003C398E52454E1,SHA256=42B90E59DA578F7FE260ED52D0976D78519E51E03E1D961CEA40F3AB85EB9477,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156555Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:06.111{27B03E6B-D3BA-60B9-2A00-00000000C501}2856NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098405Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:07.877{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E5C6024F94D6EEC51E6F98D820D318B,SHA256=2CCE61DDF589D37A16161C478B998ABB006FB81E84AE98EAF759183D6CBCD67F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156557Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:07.361{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5B027C1DAC3998FA50B58C2BDFF7758,SHA256=DCBB7F428A8A906D94890E056B5B73DCB88B4A78BE6DCE8CDA5FB28D22CE2C6B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098404Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:04.488{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50150-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x8000000000000000156559Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:05.497{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57970-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x8000000000000000156558Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:08.408{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C767111DAD06C106C1AE567F0355384,SHA256=86949C22998CFB1519E29E2F8FAC862C055C8188C969DE230FF46974BB3E3728,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098406Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:08.878{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC2C5948384A4F67D0478B546D342C3A,SHA256=BBD01AA714C6669924888BF7751F5680BF492E212B673B866BE4CE87ADB4667B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156560Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:09.549{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=888065FA3D135890071BAAA5570602F4,SHA256=06B282D6CF687CC7E3C0D8D8E9849B841E08C5A2556BA0144AEC2E8BF8AB5EA4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098407Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:09.880{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65ED5FCBFE4C9E3C62360C4A09ACB89E,SHA256=EBDB5C8374705F8821B5CA7DB6F153D254FF675DCAE909CD256FC068C24691B3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098408Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:10.882{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D34DB6D9E4EFFA15E756FA9C6D02E34,SHA256=CB200372814E6B04E1F3590DCD3FFF232304F029D7BE97C8AF5D749366A6168B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156561Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:10.627{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBE09838985A921BA7A128FA3BC44D12,SHA256=93EEF317E9D0E129B40F94A2DF2E427CD1A4349F9AF87F6C22C22068703D0BE9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098409Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:11.882{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5D0D97C4CFF1DC0D6F526A8C638B3F14,SHA256=EB086FE24E9ECF5B5B8ACCF8068C8B14590DD9A01119181CB60FA50F09F71751,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156563Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:11.627{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3778419CAEE3803B138F48E366A4EC6B,SHA256=09C74770D39AD2B7B63F8547B533D18ACE2351E924457A44F6FCE8E20F908045,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156562Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:08.419{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57971-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156564Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:12.627{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA670C7ADB14D1E62C7FC9691C8EEFAA,SHA256=C6537C5E5780345B872F7107F182AA90243486527E750F28F2664F79283879B6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098411Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:10.414{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50151-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098410Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:12.882{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A83048F5563D0F0741BFD1C612AF4056,SHA256=857DCE19996072A2C93AE818B872908AFEBF28D5E79C99BB5902A8CF43B7301E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156565Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:13.627{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB60ECCEEF6764FFBD6A58B707A30F59,SHA256=FF68927506F10CC076AA279A15E8E0FF4949A6E76A15C29E24BA9D88AE11BF32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098412Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:13.883{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=28349CFFB8238A5B484B80650005BF82,SHA256=DA3B9E9324805ACED35FD90909D4862857BD6B86D04C2DC2C990BB5862880F31,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098413Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:14.883{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=249157340CC0B86F2DE305EA711E82F0,SHA256=06440AAF895223C1DE7C5FE12B644BAE4F28FA021A82A09B6576C217740B876E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156566Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:14.627{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=543CA1E4F2072A333B6B6883F48564C2,SHA256=8293B7750EE31D10CAEF4879356410E71CE2CC1F122C93AB4EB81BA7665658D1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098414Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:15.899{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E307C4E8CA19F6C76CEC788AE44F63D,SHA256=8015AF7967A3C0B88CD5D6DAAEE2C5756287F43B55D30624D525C71CE8EEF39C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156570Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:15.971{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=352D8F6A2B7D7B31122552B8EF465ECF,SHA256=72E99FE6E6A8F5371A3A07A0583704EC943130E416F3A983DAB9FC68D5CD9DAD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156569Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:15.971{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=30B1DFE7F406AC69357CD956E160C9D1,SHA256=308D91D27D1A1A427ECFB5523AC65830E268DFABC09DEE96560871582FD1EE05,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156568Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:15.658{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E07B56CD535D6BAB68AF3B1C9990DC77,SHA256=3A57473F734752A53E5FDA95CBEE214A75AAA4CA19CB6F69E463DC68CB37B716,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156567Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:13.638{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57972-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098415Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:16.899{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5BFE3B5FEAA943621F111105091D4AF9,SHA256=F8C4C7D942A9A3E4F46ED4FF18EA926A2DDA5F2E9B658342623C5A5193ADE85B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156571Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:16.658{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9A0635DBD4DE32AD7D4949899742B67,SHA256=CCAB90768967C6BBB84F93E1491CB830D6BC05D1F9089568FB9919D03261D50D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156572Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:17.690{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8729709100FD9FABEED95D4FFE3C0DDD,SHA256=49B60BF92B9EFF608E79240FDA4F964B989D10AD4F7D228171638785B343B5C8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098416Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:15.414{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50152-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156573Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:18.721{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A640EBA11F964B595F1ED2E568498AE,SHA256=2FA69DD211B79F89B9A9FB4D23D0D7FE1238325F0AFA61CC2725286DAE09D6EA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098417Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:18.134{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6F2EC97627C11109DB39D0A58FB764F1,SHA256=2A01C781D6EF0976EA59373E57707C25D6E40FC42E3A5898D6A6CD76EADA514C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156574Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:19.721{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7194AE3B633B798B3EF35D035E7FC9D,SHA256=13DF9835BD2C81370BCC7DFE0E76C8C69AA66E7E71F35FC76CD0F68EEF1C980D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098418Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:19.368{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C207BB774DAE5A9D7BA4D3057222146,SHA256=714D8159724507757BD0CA8CE86DEAB0381230AECEE57CE3AF1656259EF62392,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156575Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:20.737{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04A9400FF57F78413E6E53C578D9EEB5,SHA256=2B1AF928CF2A0202007B22B5CD7169486CAD49DBD9883552CCBB2EAAFC7A1A98,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098419Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:20.587{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=337887386FB207C6FAC77AD50EB72CDD,SHA256=91BAB526C5EC0454F78AE5FDBE12E9413CF829A2709FF6CE9464D210688EB367,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156576Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:21.752{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=44C92EFC541A22825C75458E396C81EE,SHA256=585E234D5F1840FD62390EDBD1FA79262B05C22D71E0D84D15E5E3874FB2BCD1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098420Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:21.744{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=379A526294BC43C38B2FAA87AD31FD20,SHA256=D6C17427D1189B970CB57FDDC9F0DF33540EEC2E8E5BB4619C03A3FA08798808,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156578Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:19.591{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57973-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156577Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:22.784{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DBA5CBE5922E3A9C5A9C77B15C7A46CA,SHA256=BFEC2D14615846DEB785177EC7E0F8ED24099E741A58F5B16685422EAF400BF9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098422Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:22.759{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6769F395A97E1395740021210A6A199A,SHA256=4FBF52114F5E4E0B84CD6108D6B31721A7FE1558625A8B092D486B83708563C7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098421Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:22.134{38D812B3-D3CB-60B9-1C00-00000000C601}1936NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156579Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:23.784{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2B2E286742971F114BC6201D4109027,SHA256=B6F3AE1C82FD85FBA0AC4B90ADAADA96350D7BB80084B8719070F73455D14095,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098425Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:21.368{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50154-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 354300x800000000000000098424Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:21.352{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50153-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098423Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:23.822{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=682B6E65D50B378849D8E7A4BA48D7F3,SHA256=DA7C0DB9BB52BD8704A0286F5BC58B37610513E93830514B3409FAC3E415E03A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156580Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:24.784{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13F32388896BEEBB8E2B5517111D1CB6,SHA256=43B57E7D71298C4C8ED6FB3392F88FF042DACC8F8F89D4B5DBC33E18B788DA7E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098426Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:24.932{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D1EA60023C178FD5C05CFEB62DD3202,SHA256=CD1AEC96C00F87290E8B7EDF85A6319DFF9C0FB23650D4B98C73FBDDBB61F283,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156581Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:25.815{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DDDBD1FFF1E8EDFC7B3309F3D460739D,SHA256=681498926C466ED1BE2B2F83A699B6A32AE68B0C8EF13DD74847BC28483E9057,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098427Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:25.932{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B7D92558C2EC6215AC3AE40C3B7481B,SHA256=792119DBFF0C35320B126671D52B10613C99A1F4D5C6D7BBC2B5B40EC2A640FD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156582Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:26.831{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E91346D17857B24357E5DB43D9ADC2AD,SHA256=BD7DA9921F2879A2126903061EB22B2135FC039C161D7C8DDC3EADD346EBE6BF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098428Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:26.932{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8ED84EB4B736C743AD22BDFD1A7DCB06,SHA256=ADF2A7D745B9CBE06A2243649628190132F6B748BA7554CBDBB0BBE91BE67E4C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098429Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:27.932{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6530FC5043206B27B82D99CEA94757F2,SHA256=99807B7A40C7E5F27D9722A0C8613BF8D373C28532EB59A71FA39436E7865D7F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156583Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:25.544{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57974-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098430Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:28.932{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=606A01182CEF89553E82B6E91BD2E64E,SHA256=61693A5D6106490F0EE559555633CD4A53B8EE2F9F980AF2AA864A52449FF086,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156584Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:28.049{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=161610F5DA016A9CDD8A6BA89C5CCF91,SHA256=77DB150804D01981EE74549BE85A1E60FC7B3DBF14C15A7FF2D426F0608A6D06,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098431Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:29.933{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C2BA945089D822E76FBBAFDA7084AA5,SHA256=A2DDE889AE1A7717371BA4DA7E505F4A46C606C552B7A791EE09695BD7E7B093,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156585Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:29.049{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0127668B71BB290B289B662C149F4A3A,SHA256=54D88EED229E06B74E6E99979F5FF8A909803B23A1C40278D33D2206276FFDD0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098433Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:30.948{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D40BAFE7060A9478BFBD28584A3AB858,SHA256=0B6455597C3865837CF5BF279348DA3A21A26881027567E1D2A78E0E9B8EAE12,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156586Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:30.175{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C0ACEACCFAEE79F3321F902DF8D69E69,SHA256=96FFF9339DD4BB172E5DEE061ACB593C2F40083C6AE5B96968B80A3093B06969,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098432Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:27.321{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50155-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098434Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:31.949{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=025DE0BAC0CA633EF758987C49B43C16,SHA256=9ACEC8FFAC2D98D512A39381E3106CC22A196580F3782BBC06655B4B405477B5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156595Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.815{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB83-60B9-9E01-00000000C501}308C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156594Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.815{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156593Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.815{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156592Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.815{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156591Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.815{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156590Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.815{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DB83-60B9-9E01-00000000C501}308C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156589Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.815{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB83-60B9-9E01-00000000C501}308C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156588Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.816{27B03E6B-DB83-60B9-9E01-00000000C501}308C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156587Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.175{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=871D0542D1ABADA01A2263EF55C43204,SHA256=ACDCF21EFCF82F7A70CB16CBC4E29A3F42017C9654824060748D8923A802AAEB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098435Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:32.949{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A08C24CDCAE082A00B19C483EC5CB6AB,SHA256=E19266F05139C83AE5E761EE17BE54BB605CDCABAEB3EC378C75DBB63F915D07,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156606Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.862{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C274788A73D45C4BAFC6C47B4FA82319,SHA256=075A441BCC5E0ACFA199BDD51638E4945DD52EA419F7163C0966E3467A0F1AEE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156605Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.862{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=352D8F6A2B7D7B31122552B8EF465ECF,SHA256=72E99FE6E6A8F5371A3A07A0583704EC943130E416F3A983DAB9FC68D5CD9DAD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156604Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.862{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB84-60B9-9F01-00000000C501}3828C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156603Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.862{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156602Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.862{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156601Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.862{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156600Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.862{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156599Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.862{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DB84-60B9-9F01-00000000C501}3828C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156598Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.862{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB84-60B9-9F01-00000000C501}3828C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156597Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.863{27B03E6B-DB84-60B9-9F01-00000000C501}3828C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156596Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:32.190{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12F6B87C95FE1D70EB1A8A76E8A8E6B5,SHA256=D8DD0DB18C080D264E3FEAB8305DF82C194F3F9D787604782A40F5B691D6F704,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098436Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:33.963{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFDD74710E4C40799E04CFDC421DFDDF,SHA256=998FA1ED98A61A9AABB7DBA071E0AD25E8E758D6DA118057A0AFE3946CAF09DB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156617Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.862{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C274788A73D45C4BAFC6C47B4FA82319,SHA256=075A441BCC5E0ACFA199BDD51638E4945DD52EA419F7163C0966E3467A0F1AEE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156616Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.518{27B03E6B-DB85-60B9-A001-00000000C501}57681816C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156615Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.378{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB85-60B9-A001-00000000C501}5768C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156614Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.378{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156613Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.378{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156612Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.378{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156611Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.378{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156610Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.378{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DB85-60B9-A001-00000000C501}5768C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156609Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.378{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB85-60B9-A001-00000000C501}5768C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156608Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.380{27B03E6B-DB85-60B9-A001-00000000C501}5768C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156607Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:33.222{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC5F7102F974045AAB0A0B834F594B48,SHA256=969CF600609518B028B503EB4823B5A35282C76B94ECAE113963110C86A39467,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098437Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:34.979{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4BF257C06278EB2C0B1D8E2E41814939,SHA256=4441B8398479BBEE35286378DD4B581BDE23D094B4661411214771DCA8076835,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156619Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.419{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57975-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156618Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:34.409{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84D72CECA914DA75524EE9D69C66D57B,SHA256=CC36D251F515137790B9932D6B1A11740C90A4736F58D5437F9CDF658EAB8211,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156639Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.987{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB87-60B9-A201-00000000C501}5200C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156638Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.987{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156637Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.987{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156636Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.987{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156635Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.987{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156634Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.987{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DB87-60B9-A201-00000000C501}5200C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156633Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.987{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB87-60B9-A201-00000000C501}5200C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156632Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.988{27B03E6B-DB87-60B9-A201-00000000C501}5200C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000156631Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.472{27B03E6B-DB87-60B9-A101-00000000C501}33684372C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x8000000000000000156630Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.841{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local57976-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 354300x8000000000000000156629Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:31.841{27B03E6B-D3BA-60B9-2600-00000000C501}2784C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local57976-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 23542300x8000000000000000156628Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.409{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC42B823ABBAE9C9357E747ECA6BD4BA,SHA256=A264FCB1CF30B5D03AD6F6C88521D2F09BB1E77FD94D3FDC95F2C0C2EF738B6C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098439Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:35.651{38D812B3-D3CA-60B9-1300-00000000C601}96NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=4F2766A90EAEF31C93F7718E45DBA264,SHA256=583569E149C203E95CAC3BAAC63CEA6DF01A77A326511A7EB8AED532E95B626C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098438Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:33.319{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50156-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000156627Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.315{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB87-60B9-A101-00000000C501}3368C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156626Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.315{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156625Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.315{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156624Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.315{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156623Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.315{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156622Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.315{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DB87-60B9-A101-00000000C501}3368C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156621Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.315{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB87-60B9-A101-00000000C501}3368C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156620Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:35.316{27B03E6B-DB87-60B9-A101-00000000C501}3368C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000156651Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.800{27B03E6B-DB88-60B9-A301-00000000C501}59085880C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156650Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.659{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB88-60B9-A301-00000000C501}5908C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156649Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.659{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156648Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.659{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156647Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.659{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156646Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.659{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156645Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.659{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DB88-60B9-A301-00000000C501}5908C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156644Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.659{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB88-60B9-A301-00000000C501}5908C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156643Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.660{27B03E6B-DB88-60B9-A301-00000000C501}5908C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156642Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.409{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=325D0BFA6CD157175A84EBFC36B424F8,SHA256=09F26FEEE69AAA401B0303B8A779C6C9CBB7E9075D5E81F7D32BF3DC4C80AC49,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098440Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:36.214{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06D980AB625E83492464180D6EFC3DF2,SHA256=2798E1209BAA2BD15BA397A0C26598A401999344B531D26F06A1454119CE2CBD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156641Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.362{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=76B3142466D6EA99C7089A61E6E0090C,SHA256=733C615A9C8D3622440AD96F2BEF4F3FDE976A0ADD9468327D9DDC66D82907F0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156640Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.159{27B03E6B-DB87-60B9-A201-00000000C501}52005828C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156653Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:37.722{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CA8A0B32A9240DDDF72DD200FBDBE742,SHA256=84EC2CF91D3AE359DDA6669F985EB1876A3A743D3F16E4545F917FDCCC473E93,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156652Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:37.409{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A0A00E64C2ECBED581F7407AF711DAB,SHA256=9AF10B2671987B0D12E317DBA7026F784B42559E1C3DA935C0FAC7DF88261376,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098441Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:37.355{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=884A4C1E57749DD0AAA91557A53DA306,SHA256=81C498FD9F97188EA2DC4CA6DAA45A16C599C9AF46EB34FFEA5E8FF23D07A7F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098442Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:38.511{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1856F243AF0AA592F59C2862C7BD1D9,SHA256=D74017EFAF335EB96C2444D59EA90159004E362675DD1956C95BB397E14A7BA2,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156663Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:36.529{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57977-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000156662Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:38.487{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DB8A-60B9-A401-00000000C501}5992C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156661Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:38.487{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156660Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:38.487{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156659Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:38.487{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156658Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:38.487{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156657Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:38.487{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DB8A-60B9-A401-00000000C501}5992C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156656Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:38.487{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DB8A-60B9-A401-00000000C501}5992C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156655Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:38.488{27B03E6B-DB8A-60B9-A401-00000000C501}5992C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156654Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:38.409{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3EAF4FEC83B26CDC85BEE496BDDE6CD7,SHA256=EA6D9A8459944702932D71E447E2F2D353265FAB393C3263AAB1B66DC4C5BAE5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098443Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:39.589{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E99D01C171C51099D3E7275E2A043FEB,SHA256=640900A3649C735739BD3111594855FC571CA2FF41F2D7715EE3FEF74613233D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156665Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:39.503{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=04B41A01A5862B961EEFD6AF7D821CA6,SHA256=033F7B59BF5849A1F26CC727455D3054C7A0D3EEE339A69CE583FAAB6DC1C80C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156664Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:39.409{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5EF2DB538A98A3D1F1D413B8A02AA9C5,SHA256=FBCFA20124491B5B88A6EFE3FD956CDD4BBBAB934542B8BB15CCF8F4BAD07E6D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098444Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:40.605{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ABB52684B148AE9AE39901E3CDB16222,SHA256=5D140B3F01C7A36473A5D7025DA53A5BE4D15156668E261C9347ED5BE8377378,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156666Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:40.472{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2302B82BA27FF45240486379DCE84A9B,SHA256=AB5BEDFDACA9CB0786CA6EBEE0AA6E6DF29776E765257444A3A93A6E40A3C795,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098445Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:41.824{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7177F03892A9925E936A74013C7F7002,SHA256=DBDFCB18413001640DDC36D1C529127795CB4C60437A6B49F1FE0322D2A0D1EC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156667Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:41.534{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=95E1ABF9730461BB47F07A2EE19004B6,SHA256=A9A08BE32AB8F1A8CA7906588EC74A7B0CBF2733374FD5849CE92F6B20B41334,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156668Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:42.534{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FB1DA80BB8D22C5E7939CF7BD1FA9F55,SHA256=6395E50539BD8D677D3C7F44A612F6D158D549C72639779C0861B2D1524240AA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156669Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:43.550{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1FE5C9812D141CE8B67EB520D4524FED,SHA256=775EAB9E9B980535F1054AEBFF48B3D224B7D87B680C04B667C3FAD526F5793D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098447Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:39.351{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50157-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098446Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:43.028{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2C28AF980347B1F91B9334D3447ACE36,SHA256=02FDF761318A8F53EF2EFC5C325CD2036C8C93F03C2AB5E345427C89749E7ED6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156670Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:44.566{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=95B307A06CD74589249ACF8AFE66F453,SHA256=12E8629B8F8851C148E1FA92DF37B70548DB4C82FFB6A1D34A1088952877F194,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098448Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:44.028{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73A307CF375D34CE9F8CE82C55033E56,SHA256=D04AFC01D2542DCCF12DE88AD596D9C6CC40CF9E1A3853148858F4723A007EF7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156672Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:45.613{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=797596730D5A12999F975237DA312A7A,SHA256=6F91A6F9F7793A1CC0AF5E726E30FD1C68103BDCE66E2276FC7EF784ED6EB4EE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098449Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:45.028{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=797271EF1C801959AD39A3D86B5D5A88,SHA256=3A1123B845842D1684471F459FC99E0CD3BC34478FA6459807ABDC9DB03B2219,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156671Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:42.513{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57978-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156673Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:46.644{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE1B9EFEF052789D253939FA4A3CF73B,SHA256=3A10D4E4EAC01A2179B9AAB8DB7690FC85944226EE019CCDCD7B2C95CD085346,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098450Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:46.044{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=673432C24E6422DBE02F3FB85C95C9DB,SHA256=984A3C34EEE6B379A4CCC62BA5824BF28BA006476D2D04E970C1B8A8EF252D32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156674Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:47.644{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72387481A7730B968AA57D730513BD29,SHA256=2C6A1812AC0457E6AAD3E6681ADEBD6F1C8FB8F05D9D475B825BE62A497CA8A4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098465Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB93-60B9-7D01-00000000C601}856C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098464Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098463Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098462Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098461Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098460Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098459Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098458Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098457Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098456Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098455Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DB93-60B9-7D01-00000000C601}856C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098454Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.653{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB93-60B9-7D01-00000000C601}856C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098453Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.654{38D812B3-DB93-60B9-7D01-00000000C601}856C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000098452Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:45.288{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50158-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098451Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:47.060{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FF958C07B3CC4AACEFEEAF8945282369,SHA256=DF036A4FAA06C752B4927D2D68A7C7636C20797CE0F15D78B4DA258E45320E42,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156675Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:48.644{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E8BF884F1D85C5E206108B734C0A2468,SHA256=6901501D2430AB5E7E4A97BE094763278715F7B010D9C3FC9DE268C00ABF0E92,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098482Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.826{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=965E232C1EF201DEFE8171A03619CF8D,SHA256=BA61DB96B4541EAA8D40C96FBA80813302C4AE35DC1DCD4F50D43C484C31DFD9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098481Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.826{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6A04537E586203C3A78B15B3C1A91D36,SHA256=E910A93CB5F98BDF382DE2B7F23899E7AE2B5D511761FAD1274BC6272A8B5EEC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098480Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.450{38D812B3-DB94-60B9-7E01-00000000C601}25722280C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098479Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB94-60B9-7E01-00000000C601}2572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098478Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098477Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098476Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098475Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098474Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098473Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098472Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098471Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098470Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098469Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DB94-60B9-7E01-00000000C601}2572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098468Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.325{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB94-60B9-7E01-00000000C601}2572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098467Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.326{38D812B3-DB94-60B9-7E01-00000000C601}2572C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098466Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.060{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6B9E0DB6A1868318B71B38F5902AA3A3,SHA256=EC8D01D7776FB1BBF70B619C6506310C684DA59BA51DFD6E3A7E1CAE61B8F731,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156677Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:49.863{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DFD5438F20F8203AA3076D0E811C21AA,SHA256=54FCFDFEA86981C10F3C480388F5D6A1F2447220DE11300A3B4A10CBED3B46C2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098496Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:49.107{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C0A19513FCF0C8CC94C91AF63D5DDEEF,SHA256=E88645781334C4D6E2F460963CF0FCCDCFAD5DB7014659254605872D6BE3F8F0,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156676Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:47.529{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57979-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000098495Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB94-60B9-7F01-00000000C601}956C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098494Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098493Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098492Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098491Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098490Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098489Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098488Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098487Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098486Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098485Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DB94-60B9-7F01-00000000C601}956C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098484Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB94-60B9-7F01-00000000C601}956C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098483Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:48.998{38D812B3-DB94-60B9-7F01-00000000C601}956C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156678Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:50.910{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A291599522730CF2435FF55AB6685B27,SHA256=B3548B03A2037BBFFD6545C88F82CAF0D0E5D2FC5A7CC9FF68FB3A5F87BB6C6D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098498Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:50.154{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=911452481ACBC265F42B3A0F33B59410,SHA256=9F9B88C1297A66212BCD7575BA1C5E3B72BB561A64046E9E40867FAA247C6DAE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098497Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:50.076{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=965E232C1EF201DEFE8171A03619CF8D,SHA256=BA61DB96B4541EAA8D40C96FBA80813302C4AE35DC1DCD4F50D43C484C31DFD9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156679Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:51.910{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3376C751AD4612D020CF64BD3531ED04,SHA256=A67931B117399558875E7FC1CC1AE82023E18E763EBF5E67B663AEFA6B823427,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098527Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.889{38D812B3-DB97-60B9-8101-00000000C601}1722236C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098526Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB97-60B9-8101-00000000C601}172C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098525Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098524Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098523Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098522Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098521Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098520Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098519Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098518Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098517Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098516Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DB97-60B9-8101-00000000C601}172C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098515Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.748{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB97-60B9-8101-00000000C601}172C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098514Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.749{38D812B3-DB97-60B9-8101-00000000C601}172C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000098513Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.248{38D812B3-DB97-60B9-8001-00000000C601}32882952C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098512Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.217{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E1E3776573736D15267F148AC71499A2,SHA256=BD1268437EE86E9EC819514E8B04DAC3E236462593D6AAE14729AD84C100BB0A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098511Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB97-60B9-8001-00000000C601}3288C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098510Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098509Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098508Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098507Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098506Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098505Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098504Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098503Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098502Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098501Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DB97-60B9-8001-00000000C601}3288C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098500Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.076{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB97-60B9-8001-00000000C601}3288C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098499Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:51.077{38D812B3-DB97-60B9-8001-00000000C601}3288C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156680Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:52.911{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CBA9049A1630008AC7421B30EC5FC108,SHA256=44FA08FAB481EC391E7D6BFD01C634C13971966C2FCA22B5A60AC3EA741602FB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098543Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.545{38D812B3-DB98-60B9-8201-00000000C601}25962740C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098542Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB98-60B9-8201-00000000C601}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098541Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098540Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098539Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098538Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098537Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098536Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098535Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098534Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098533Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098532Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DB98-60B9-8201-00000000C601}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098531Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.420{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB98-60B9-8201-00000000C601}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098530Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.421{38D812B3-DB98-60B9-8201-00000000C601}2596C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098529Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.248{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=387568E734BAB0F026C913CAF218FDE3,SHA256=A16DB0CDB008B672EB40B62EA25691D95C18D1A60FE2B2AC3EB9A9099CDFED96,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098528Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:52.076{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D140FA5BA31D8E2A1A4B58B9800A5CA5,SHA256=71AFBCD762F80D1E31C2FC04F07CEC3B79D0F7D17B0378BB9A8809C5CD795923,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098546Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:53.471{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CEF17A995A8BCC0F096C9E3A0FCE2F4,SHA256=247C119074EF5C4B299DDC68D7BFFA759659694A13A18F82911D9073B4332B4A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098545Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:53.424{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C26F74A960BE9692F52E3F1C90A0EDF1,SHA256=A7569AA54A07D89B353933E89267F3D6F428B3A72AB6F0C4C133EF6583672612,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098544Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:50.320{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50159-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098560Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.659{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8818B7987C882A2FEF57B7915265E76,SHA256=ABB336FB5DDE91FC70A1B0C4240ED14634FC385B77E440D0330DDF5B1E3931CC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156681Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:54.127{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CBB33FA2BD5D9E67E0984E13BC5C8BC0,SHA256=88C2D61D80307017DFA4459962BF4DD1DF58B249A629BCAB79B3EA416F782DEB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098559Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DB9A-60B9-8301-00000000C601}2680C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098558Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098557Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098556Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098555Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098554Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098553Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098552Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098551Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098550Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098549Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DB9A-60B9-8301-00000000C601}2680C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098548Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.049{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DB9A-60B9-8301-00000000C601}2680C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098547Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:54.050{38D812B3-DB9A-60B9-8301-00000000C601}2680C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098562Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:55.753{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A7BD64D5D32C4B63EACCE7DAE49674A,SHA256=E2A6B13460FEAD20FA5CA9FB13134C0B116A099171A19776313F1AE3F9ADBD33,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156683Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:53.497{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57980-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156682Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:55.365{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20A1106A7150AD651A3A96690E07CAA1,SHA256=1DC87D93E4E906DB90E1E4AEECC1E48F66EE2A7FA1213FDEE440A748E70D8B88,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098561Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:55.065{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9C1C3C27D399A5F9EA6D7EF63E76AD67,SHA256=4EB4C6BA5923E047EE71D6C4024D272324D2A9D7676DC6E5A051C2E13A3134F8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098563Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:56.800{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6116CFBC01DC1302257EDD04E277A43B,SHA256=A888D761ACB05A115528A29218D1F0E96822377A4E7026B1648C23094D3173F7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156684Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:56.412{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=43726CD070DED0903BC837C800C72512,SHA256=BAA2D5D5919F31FA9AD8F5FF988E38FF52421AB07753CB1BFC87BEED189CAE33,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098564Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:57.831{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21DABC062E49BC753F3BEA96FEB3E8CE,SHA256=C6AFA646D0BCD9E54353BFA9826CD327FA7842959DC7C176176BF1C7C7FB147E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156685Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:57.412{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F74DC9247016A5233B063AADA5BFF3C8,SHA256=7EAC9A90E0665B44D6201D1BF7F92E236EB40F7B2CDCF84A935EB4926C0808E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098566Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:58.972{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8783ED49570C1F2E7E737DAB30B2D47A,SHA256=D5B79AAFF336663B4F03E340F23DC8C3AECDE0B9D3F194B38326EA8811F30ABD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156686Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:58.443{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C77D3930CECA7A4DD36E53298A7BCBB,SHA256=8F7FB47F108455AB1CB75C822D4C9EBA5A7278B36C4B708CD27A51F1D972E4DA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098565Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:51:55.323{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50160-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156687Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:59.552{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9A7BE8FAACDE3DB6FB4D908104FE67A7,SHA256=F614F3A8124D277C17BFC3DFFAA5310AC74D76157E512F28F7AF50A8B79141E6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156688Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:00.599{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=045D02CE11CF8F42277F629BBACB6DD0,SHA256=60B0BF2E2F003F320846332A9EF713AA87CDAB1F729F71E2EF891E69B1979D7B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098567Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:00.175{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0C6A2D6CCBC4B320AE584C6B0A60D3C9,SHA256=8113BD901B63DE428E8F3F24370705EDF79749FB9718F71C98E6DCB61D6FDC0A,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156690Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:51:59.468{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57981-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156689Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:01.850{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D21E1A5BFFD1CDBBBD574D120989BE98,SHA256=33B203A7E6C6D9FF1EAF4846D5DBE7916E2ED49775892236544549B661DDB4E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098568Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:01.363{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EF658DBDD9AA787CC17E429632B0C1FE,SHA256=C527DDCD899D71731FC0D95C57C2B8C57781521D30E382CA6C8A9797311021FA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156691Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:02.865{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA066F107DBAB4FE08267A84D81F5996,SHA256=F7AB64F52A724E02484C2F5244DCB2F9F32736A47F74FDCAD9110A79B9EB249C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098570Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:00.464{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50161-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098569Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:02.520{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2CE522052C08E11198D2A4597A504634,SHA256=26DB172108F6397BA6AEF847CBF90FB576F49504C2F423B2AE38E40CFB9489B8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156693Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:03.865{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6CE205B6955FBA403BFA91B8C818FCF,SHA256=61718F070A77F176765F2CE40405E90D23AEBECD360D80B8D6F5627F1F6EEAD7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098571Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:03.645{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB9BD28057BFE5A23FD36836418F7701,SHA256=2B2A2DEF43AC9424645F4C5FAFF282E666CE71F517BFA07E07889957D2CDEAC7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156692Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:03.193{27B03E6B-D3AA-60B9-1100-00000000C501}380NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=09162F85EFE425F1B915FAE59B94D701,SHA256=DDCEEFA890E8A5622B98AAE7F82FB292E1E99B910AB578BC330CEDB0A9C89ABC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156694Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:04.928{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD3C8ADC395182F23F0FA58B1407DFC2,SHA256=38C5088B6BF25FDFA4A9A2459F20937D94742671684F0EC5727CD328B92A5731,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098572Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:04.723{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC33344CADCBAFA11AE73A1E1FD3AC5B,SHA256=51F07737211E09420D6FB54654B8647B4E0A7A00E163A2B22C8601C1FA20439F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156695Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:05.959{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3298A61906766208AEE165AE96CFA19,SHA256=BE722A914373F40EDAFAEE710C873563C316421A2D17CDECAB45EF038444BBF1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098573Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:05.833{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4CFE83CD129DEC5C5A5E2A90726EE7A6,SHA256=8D0F8960892F7E0EED3D7365FDF551154CA9469B6002A960DFF110E9864C1B1D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156697Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:06.959{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84091F8370F1C8529505F869DF4A2107,SHA256=13A3DB689B0358EA8F2750C789499DD0B2AC7EDDB9723D494DC3EC8F82A662E4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098574Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:06.973{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=79A5AA37BC84324ACE2D4E5B58C70FA3,SHA256=8F69CE4D4D5D777B6267EF9277F225E2A091607EB116DEEFBE75411C4EB1B724,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156696Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:06.115{27B03E6B-D3BA-60B9-2A00-00000000C501}2856NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156700Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:07.959{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=213BEB3F0B7E5D4B60DAEAA7F6064797,SHA256=9A72CF191CD554FDF8C7EBCCFA4A9F30160DE2E03ED302E16097B0EFDF463A72,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156699Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:05.515{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57983-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 354300x8000000000000000156698Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:05.484{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57982-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156701Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:08.959{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9BA2A34204DDD42B95209ABABC80A3D4,SHA256=F8994CFB26DA0DA93B8ABC464E9F2D7152628DEE26C841B0FD4EEE4F26AC73CD,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098576Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:06.339{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50162-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098575Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:08.177{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BB6FC17BEF49FCD089F152245A07A61D,SHA256=89548971C99F015FC843C98F11922864194A0F4CF1CFD695ADF8A15778E1B0E5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156702Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:09.990{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F4106C548AAEA418B748DFEC838F1734,SHA256=CB4BA563680857EE80B992B2EC3EDD1CB5189CA02442D45121EC2D2F77E9F20A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098577Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:09.178{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9FB7428B0D59B3130B20617EECF8137,SHA256=363D7493CDE38BCEC3AA759A532F5ECE91897B18BAB4F5176970FB5CF187BB76,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156703Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:10.990{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=12B413448988C3811E058FE4D95B8E37,SHA256=4494FA0B362497FC54308DAEC18A699AFC3649B7D0F03D2FD16C901E5EE34FC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098578Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:10.192{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=95EA48063A7E5FADA1017E414FB31584,SHA256=2AFDBFCC0CE0213A36B7D54289FC56144E942F866E3B44C793C12D5EE2B58D17,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098579Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:11.194{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFD863B5F6381252AFBF18B472F10CBE,SHA256=B9CDDA23AC30B5ED7F92DAE0428B19E98C4E18E04E027ED7E5CDA35C58010B11,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156704Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:12.006{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2128F85AB3A0DDE58757196E9E1C1B24,SHA256=37911FD148C79A78CE4663D4F44049C076111DE544E1461CAAA6C679EBE0987E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098580Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:12.210{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D2A28A72E6B8976D61E9C5515CFA3E34,SHA256=24D06B766B73CCDEB48DCDF214879A198FA99A179FFEF8BA13A4502869404397,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098581Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:13.210{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E2182098573DA7E1B9C018E5180A0BA,SHA256=B73595C82C1612DFCE47D682835563B3FA97D26341534D3E97A1F9B006C08AB9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156705Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:13.006{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4B2F20C8DD663459BC03BD07CE9BCF04,SHA256=C036766A13296E47319579D2D400EEA2310D9470B743725F1F9FEA6EC13F25C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156707Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:14.022{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D267BA55C9FD4F28BE51231A2879832B,SHA256=661864C31BEBE5318DA91AD798C548AB7FAC695391401DBE27DDF00A808F4B3D,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156706Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:10.641{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57984-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098582Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:14.214{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72D050A89008048DBBE8E540150EF2E5,SHA256=1E12D47D84D88EB98B4829AB8B1860626DD3721E9E5B2E32B60CB7B199063DB5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156708Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:15.084{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99C96A3FC852F036F68E7C44DBAAAB6F,SHA256=BC62901897AE34F4A7857EF60265CF8C27A8CB6CE193FE82DA60A5C77004A9A7,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098584Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:12.309{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50163-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098583Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:15.214{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7E06203065364F6E25F22E4163DD2E1,SHA256=3883C8DB211427ED17B8CCF4C20E17E6CBEE4EE1C795F4F672492536C4FC4A16,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156709Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:16.084{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68989A53B884427DA6B5C2555538A466,SHA256=31B36BF5A2EF7ADE0ACDC91A3E2D13C04C5B9A5E7DF99FE67756CFC96B45D780,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098585Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:16.230{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56E66EDC56857E40F1495181BA0F856F,SHA256=2E765EC9A5A3CBF3AADE16010EE83F8854C8E2A7EF5766BF0D517BAE5BC7D563,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156710Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:17.100{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F9A4986C5AC675F7043505E654EB9536,SHA256=D265619B4FFEA916F48E314AE1E6A11CA7AC7A5DAE291DCC7A4ED24F6F87B774,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098586Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:17.230{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=303AE135EBD905BC94FC95ED7DCE3AAC,SHA256=2CF2F4569B903AB87E1C5FF7165B8B1314A5C11FBC3F779AB94302A8FE022860,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156711Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:18.116{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=777D360580E988C84C30B693FD26EF6C,SHA256=C6AB470A654ECA66DFE77AF4BDB5BBAA9E55544AB995C365BA8E4FD983E2CEDB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098587Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:18.230{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=30C9FF26578574B7610D435BC5254D41,SHA256=C76DFAD7C6BCC979B1FD41D6C187EBA627EA6C2A7C6AD773B8B44FC491EA20A7,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156713Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:16.609{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57985-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156712Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:19.116{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1BC0188BBE2DBDDEDD27DEDF141FDF8A,SHA256=1CC20689503BF2FCB6C9D889FB1A15B5793AEBF3F0F03D1A5010310D229F900A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098588Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:19.246{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FEF101356905E461F4AE0D2D4FE0F083,SHA256=A02B0C9F1C7F89C620E0CEB22A6BFA97E8968B96B1FEF20B04EA686766DCA221,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156714Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:20.178{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=463E1B53B3919F826FC42DF6DDA602DB,SHA256=6655C7BF64D246D24EF156E3397EF4573F4AA2C9B6A68A88B63FB004933948B1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098590Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:17.438{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50164-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098589Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:20.246{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBF6DE4B36A7338860CCA855FA52C76C,SHA256=4FFE7975A433693548A33D35F5C486DD4DB656F1F334E8A0F7BE4F9EB76AC6D0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156715Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:21.178{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C3E2124A89DB967F5FC06334E348AD1E,SHA256=828EC54AAFBF5C3811366DE9AD8345D717C13B5BB5B66FE31DF70254E3A0EA2E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098591Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:21.246{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=85CBA942CB7B9CDDD542377247D7E5B5,SHA256=12775DFB987AEDD346FE41F2A6889E4E94ECE2F513FBB2A9873308BE7952F3A7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156716Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:22.178{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3948568767992C380DCC959D045E5298,SHA256=10542E72F348C7A7EBFC9A2C59453135297952168BDD2E156E1A82C2E53EAA22,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098593Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:22.262{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9E6E04F220E9510FFB6E750519BC7CB6,SHA256=483659607582B201A105DB7513B0F41D9524DDEFB05AF0B107A82F221282F82D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098592Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:22.168{38D812B3-D3CB-60B9-1C00-00000000C601}1936NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156717Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:23.178{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C27523058D1A31D90120B243E1C848FE,SHA256=A83EF97580AD47D3B5DBAFE5E56F98BC687D5622A5C50F48F22B5719FD25E88C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098594Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:23.278{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F536DDF9A828E079C7480B049E0643F1,SHA256=965AB106624F537F954B6EEC6C4F359E8B64036A9D219B9A22D1E0E3B6D7E287,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156719Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:21.609{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57986-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156718Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:24.178{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D86DCF4CC721D9840F4C6659F9B7C4B,SHA256=162B27F85C64018A7441E569722503007423C68F183C5F2BDDBB0D8F36EF80C2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098596Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:21.391{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50165-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000098595Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:24.278{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86A4B0017D3665AA2D0F754374089C05,SHA256=D8D0F04105E9B56837A139AE5684E7CAC53C92B286B9A298DABD1EFEF07D4775,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156720Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:25.210{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=63FA9BA10EF58D65B35E02397968CA06,SHA256=E2AD96F7B1DC17A1D79BA0B967900CFE78D11336969FFF75ECC026F25C0F4580,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098597Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:25.294{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4334EB75CE200DCBD814FE40E4642FF4,SHA256=2517F97F2B8E43116FB5336EA2DD4A1D43834D6EB5E1D4C6DAADF1F4D79E8803,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156727Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:26.960{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=6D53B810AA9FC0E4973E6DF0C34027D0,SHA256=4346A6A1DD424113EC643B2C4EBB8FDF10249224357C0B1084DBECD8D4DF754D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156726Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:26.960{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=0C5BF2056CD559D6EBB873E6980A2F67,SHA256=3FD827EE0AE719B390EECF4C0DF3FADA37D18C90E76704B8D77AA71B72D484CD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156725Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:26.928{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1600-00000000C501}1212C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156724Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:26.928{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1600-00000000C501}1212C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156723Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:26.928{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1600-00000000C501}1212C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156722Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:26.866{27B03E6B-D624-60B9-EE00-00000000C501}45404648C:\Windows\system32\taskhostw.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d832|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156721Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:26.210{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2712C9B2A08455F37482F6721F7ADF97,SHA256=A5CB82CE492C2D93CBD3DDACC3236799C862235A1FE98CE11E8A7C56A8B7D806,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098599Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:23.328{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50166-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098598Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:26.294{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE5FFD67C812D610211439B1067A03A9,SHA256=59DF6A77D15276433310F0ACB1481E53C26B8C75F2D56EB18149EECFD9941026,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156734Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:27.632{27B03E6B-D3AA-60B9-1600-00000000C501}12124224C:\Windows\system32\svchost.exe{27B03E6B-DBBB-60B9-A501-00000000C501}3364C:\Windows\system32\DllHost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156733Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:27.632{27B03E6B-D3AA-60B9-1600-00000000C501}12121256C:\Windows\system32\svchost.exe{27B03E6B-DBBB-60B9-A501-00000000C501}3364C:\Windows\system32\DllHost.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156732Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:27.632{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-DBBB-60B9-A501-00000000C501}3364C:\Windows\system32\DllHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156731Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:27.616{27B03E6B-D622-60B9-E100-00000000C501}11484684C:\Windows\system32\csrss.exe{27B03E6B-DBBB-60B9-A501-00000000C501}3364C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156730Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:27.616{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DBBB-60B9-A501-00000000C501}3364C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156729Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:27.616{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-DBBB-60B9-A501-00000000C501}3364C:\Windows\system32\DllHost.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35069|c:\windows\system32\rpcss.dll+3a852|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156728Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:27.225{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=015870B513ADF94855FA2B32D371FE8F,SHA256=FBDC82BA6BD13DCBB0B7AB17FA73F4DA1EEE593A21B285D1ABECFF71BE2A11CF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098600Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:27.295{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4C0D610D3906034B42E6E822DC7238C8,SHA256=18743EDE0E98FBE8A902A51ABA9728DDD9E13CED33825A51ABDFFA6F7BB930AD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156738Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:28.632{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B80E32A6084DEDA4FE543BD5FDF981E0,SHA256=39449EC88F3D7B523AF097DED4DD3BED0167D8BB38E3F75B43DDEECE8612AAC6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156737Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:28.632{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B60DB70C988BB823EFD5A202553CE37A,SHA256=0D00AE7BDC9E77A1EF41B86095018247813830A70F2F99A6EDD47FDD1DA567FF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156736Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:28.382{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D15BE96F2B70FEB8679BA95F683798EF,SHA256=3ABAF16C1460E9C89AC4218E4605A6B3B40DE759A0831B2F8657FF8D76C51291,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098601Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:28.310{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11BF91A625928110F7F2AE246BEB98DD,SHA256=1DBC291914C82F59073C851BBF0878133CE264AD714D4954E4EA8289B2CEEAD5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156735Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:28.038{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SystemMD5=6D53B810AA9FC0E4973E6DF0C34027D0,SHA256=4346A6A1DD424113EC643B2C4EBB8FDF10249224357C0B1084DBECD8D4DF754D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098602Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:29.342{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DA9C3D15EF81801628E86E23142288CB,SHA256=C388B4313E6A305689E9C96F33C2E288D8A3D0D16A750BC75EFF3E1183EB9A07,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156747Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:29.835{27B03E6B-D622-60B9-E100-00000000C501}11483144C:\Windows\system32\csrss.exe{27B03E6B-DBBD-60B9-A601-00000000C501}2728C:\Windows\System32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\SYSTEM32\CSRSRV.dll+1a30|C:\Windows\SYSTEM32\CSRSRV.dll+5c09|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156746Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:29.835{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156745Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:29.835{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156744Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:29.835{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156743Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:29.835{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156742Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:29.835{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DBBD-60B9-A601-00000000C501}2728C:\Windows\System32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156741Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:29.835{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-DBBD-60B9-A601-00000000C501}2728C:\Windows\System32\rundll32.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6f453|C:\Windows\System32\KERNEL32.DLL+1d37f|c:\windows\system32\rpcss.dll+35af2|c:\windows\system32\rpcss.dll+3c90d|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156740Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:29.838{27B03E6B-DBBD-60B9-A601-00000000C501}2728C:\Windows\System32\rundll32.exe10.0.14393.4169 (rs1_release.210107-1130)Windows host process (Rundll32)Microsoft® Windows® Operating SystemMicrosoft CorporationRUNDLL32.EXEC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\system32\ATTACKRANGE\Administrator{27B03E6B-D623-60B9-31C4-0B0000000000}0xbc4312HighMD5=23DB802097F7B7E520E40068A7E68B14,SHA256=28DE7D3E8BF4B19E44063A4BFC2E7C30AE488CD9A1F63320ED374E14AAECA667,IMPHASH=7D1CE1BAFE48B63D9D19E8E0E5DF3E6C{27B03E6B-D3A9-60B9-0C00-00000000C501}836C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch 23542300x8000000000000000156739Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:29.397{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8C1A69D23D15493B592D192475B914C,SHA256=CFC7F099FF75D00FD9C70AB40A3AFDCAD3235915D5670765E68FC3DE42F20EEB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156752Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:30.835{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B80E32A6084DEDA4FE543BD5FDF981E0,SHA256=39449EC88F3D7B523AF097DED4DD3BED0167D8BB38E3F75B43DDEECE8612AAC6,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156751Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:27.593{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57987-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156750Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:30.429{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4473C9883124888272DC2FF7FB1B41B3,SHA256=6E5FE2BAE7312A53E5147C36C41793FCE1B4AC55DE5FC5E14F303F4ED572FAC8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098603Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:30.389{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D25C145EF448154DED85918ACCF5CA9,SHA256=68BBCBF64293F29E87F35039E5A4A802F02866391948C3A228DD035451BC30EE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156749Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:30.038{27B03E6B-D3AA-60B9-1600-00000000C501}12124224C:\Windows\system32\svchost.exe{27B03E6B-DBBD-60B9-A601-00000000C501}2728C:\Windows\System32\rundll32.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156748Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:30.038{27B03E6B-D3AA-60B9-1600-00000000C501}12121256C:\Windows\system32\svchost.exe{27B03E6B-DBBD-60B9-A601-00000000C501}2728C:\Windows\System32\rundll32.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156761Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.694{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBBF-60B9-A701-00000000C501}4200C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156760Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.694{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156759Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.694{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156758Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.694{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156757Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.694{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156756Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.694{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DBBF-60B9-A701-00000000C501}4200C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156755Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.694{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBBF-60B9-A701-00000000C501}4200C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156754Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.695{27B03E6B-DBBF-60B9-A701-00000000C501}4200C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156753Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.647{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1B571211C59E144A4BAF17F11CBF5A7C,SHA256=FAFF22F00F43CC25FA4BEB8BDC3716F4EA5E7B8EBFCB02F3B4F620FCC50A7E7F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098605Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:28.485{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50167-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098604Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:31.436{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9BFB0E714419B6E10CA54347304C2480,SHA256=D9AE63B0FF794DAC6B8CA07FF9B05D782838072163F6261419A6863809FCFA55,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156771Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.835{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBC0-60B9-A801-00000000C501}1940C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156770Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.835{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156769Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.835{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156768Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.835{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156767Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.835{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156766Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.835{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DBC0-60B9-A801-00000000C501}1940C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156765Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.835{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBC0-60B9-A801-00000000C501}1940C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156764Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.836{27B03E6B-DBC0-60B9-A801-00000000C501}1940C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156763Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.741{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=CB35086CA8B007672E7CB10C4B16C5FE,SHA256=218307BF764316D25105187A9BF0628C646DA1C249506208F3264D6DA917D015,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156762Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:32.663{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D687639292C5A30CF6AC736CB85EA5E0,SHA256=319D8C2D21D6EF9E2A193915F43B699F1A83AC0C411BAAF069B796CB8C0B39E9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098606Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:32.467{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80B1B57EB33DC1E6CC6E5C6BCFEEFA87,SHA256=917E049925AF66BFE6F9A548A1BC9E6120140043E1E29309B1177CAD252BE934,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156807Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.976{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00B26C8FB7F51E9A1A8A2577835776DA,SHA256=81897F7A5447A3205AEA3D487E32B2933D250C58FF11AD1D7BBBBE191C757B8A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156806Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.976{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=47DDB3E06C8995DDA504BAFFEB3271A3,SHA256=243D815F306721B40BE7E97D522C9103CEE92C0467AC869552D955622CCC4EA0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156805Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.679{27B03E6B-DBC1-60B9-A901-00000000C501}13321884C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098607Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:33.608{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F497C10BB3C0307CC5BAEB93EBEBAEED,SHA256=462D0A1B8F7B309C576592E3DAFDFE77A37C259777A8D2D13D67D41B946A2CC3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156804Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.507{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBC1-60B9-A901-00000000C501}1332C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156803Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.507{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156802Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.507{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156801Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.507{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156800Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.507{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156799Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.507{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DBC1-60B9-A901-00000000C501}1332C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156798Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.507{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBC1-60B9-A901-00000000C501}1332C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156797Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.508{27B03E6B-DBC1-60B9-A901-00000000C501}1332C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000156796Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156795Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156794Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156793Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156792Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156791Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156790Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156789Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156788Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156787Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156786Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156785Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156784Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156783Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156782Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156781Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156780Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156779Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156778Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156777Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156776Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156775Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156774Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156773Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156772Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.163{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156810Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:34.898{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08C79CD0383AF3154460D7AF3C5C18D4,SHA256=FA1465889239A1E1F71CE2CC67683718809FF1E103C1F303E64F3A4FA14ED8C3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098608Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:34.765{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD31909CF1D3A3A3FAF1BCE60E0CC985,SHA256=D9D383BC52ACF6AD8DF424ABCF50344A989F414874D32AC73676291A9EF7B3A3,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156809Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.844{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local57988-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 354300x8000000000000000156808Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:31.844{27B03E6B-D3BA-60B9-2600-00000000C501}2784C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local57988-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 23542300x800000000000000098610Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:35.827{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2EEB112CA064A56820CA187C4D331E19,SHA256=B82F9334EB08E4619930224BD38AE5DF18099C5A9A6F43B0996A7BD4CD190730,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156830Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.976{27B03E6B-DBC3-60B9-AB01-00000000C501}220440C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156829Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.913{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D7EF3BC23830449411FB650219736384,SHA256=EF43CE03AC1611C98CFD54FD6BD92A9F14F25748B3F996DD12A040F81CF26912,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156828Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.804{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBC3-60B9-AB01-00000000C501}220C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156827Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.804{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156826Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.804{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156825Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.804{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156824Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.804{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156823Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.804{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DBC3-60B9-AB01-00000000C501}220C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156822Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.804{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBC3-60B9-AB01-00000000C501}220C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156821Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.805{27B03E6B-DBC3-60B9-AB01-00000000C501}220C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000156820Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.570{27B03E6B-DBC3-60B9-AA01-00000000C501}848432C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 354300x8000000000000000156819Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:33.547{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57989-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000156818Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.304{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBC3-60B9-AA01-00000000C501}848C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156817Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.304{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156816Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.304{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156815Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.304{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156814Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.304{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156813Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.304{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DBC3-60B9-AA01-00000000C501}848C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156812Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.304{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBC3-60B9-AA01-00000000C501}848C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156811Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:35.305{27B03E6B-DBC3-60B9-AA01-00000000C501}848C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098609Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:35.671{38D812B3-D3CA-60B9-1300-00000000C601}96NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=EF5AB1CE070F5D027781784804BA1A89,SHA256=2FE46195824CF7AAFAADBEE0CF67726A0208D947D27D704E603D86BA255A7A39,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156841Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.913{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6214EFF864B5EAA06AC867B8512AC072,SHA256=3E5759540DB3449261206859CD8DF45A456C12EBD10BB7EEB49B58861239C75C,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098611Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:33.485{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50168-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000156840Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.538{27B03E6B-DBC4-60B9-AC01-00000000C501}53641900C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156839Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.351{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBC4-60B9-AC01-00000000C501}5364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156838Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.351{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156837Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.351{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156836Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.351{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156835Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.351{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156834Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.351{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DBC4-60B9-AC01-00000000C501}5364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156833Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.351{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBC4-60B9-AC01-00000000C501}5364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156832Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.352{27B03E6B-DBC4-60B9-AC01-00000000C501}5364C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156831Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:36.319{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9A9AA048A8608EC712256B1103D24882,SHA256=DF2C7D531ADB2F85DB0B4D126F33AF6DD683362CD7390FEB159101B4DE5CE389,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156843Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:37.913{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A8E13C593CC6D5D4AB8011906794881,SHA256=917AD0C1FDD1DF1160EB63F1A490DD022D6C46B7D7F5FDEB83CD1F11FF57392F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098612Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:37.031{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4053AD6E4E3D0F328B3852A55E66E713,SHA256=F4797A01E1FC7597EEF81ED4CD92FC0179664ABB2D2E16A417F042361211A676,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156842Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:37.413{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=11D58CC65799CA3122EFECBBE9AD9C64,SHA256=979765F9EA58EEFD9E31082B3B8DEFCE730C3BEBC3DA903513D765D8EC08F704,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098613Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:38.109{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=96AEAF8EDCBB6DC2E8A3A905F605D30C,SHA256=0464D2C69BA4A233E231EFA1A64C265C460D49E2F7971D4688DEC68C52846A7F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156851Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:38.476{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBC6-60B9-AD01-00000000C501}1092C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156850Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:38.476{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156849Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:38.476{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156848Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:38.476{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156847Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:38.476{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156846Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:38.476{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DBC6-60B9-AD01-00000000C501}1092C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156845Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:38.476{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBC6-60B9-AD01-00000000C501}1092C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156844Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:38.476{27B03E6B-DBC6-60B9-AD01-00000000C501}1092C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098614Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:39.328{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6FEFCAA9D05B848D4FC0AF9DCBFD97B,SHA256=97C9A394510C832484BE73F017183B98533316A4EB21E97F3E8DD02CCD3AEDE4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156853Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:39.491{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BA54937E2DC2788C04D68FA15F605273,SHA256=01F36AEEB27E6D76BE148B7C5A0AF1F0E5141B38A355E87EFB254C8A6570B342,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156852Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:39.007{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0A49892FA17F8A8A0557400E655A474F,SHA256=3B2ABAE466186263317E4AA5EFA1A170818D0A4514D8E9130CF0A9F78E65C765,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156854Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:40.023{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4589777B29D3BE89F0C28BFB55A353CD,SHA256=7C7DB8790E680B6793ECD5748468A84F36A224EC77635E652E5B5AAEDE954096,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098615Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:40.375{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BA7BDED14ADF2F68D8D092E43A9A8AF,SHA256=322924CECFA149FC6A1DEFE6E05A38AA8ED409839C5EB0CFAABD5969A1C2E68B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098617Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:39.407{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50169-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098616Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:41.375{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=742EE3354A1D7C9986B4C8824C6AD00B,SHA256=C7C31193060DEFEBECE6270FFF36DD82AA88C5C010AD54981509993FD3A3EB4C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156855Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:41.242{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6AAEF7CC740B484C7DFA33D4D8F3397C,SHA256=59AD52B196018CAB37E9F7F1068BA5926D1C6925776E923FD81F210B5C81FCC4,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156857Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:39.500{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57990-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156856Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:42.242{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF3631DA5E6293E32750DD829B4418B6,SHA256=16354AA7E9488E8E9A43672237439DAFF32BA89A41F2E9BC2EC9DBF22BE46F35,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098618Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:42.376{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=421973CBEDA81DF4BCADC9468F83DD84,SHA256=E859B0C05B06C6A247A3E8704CE49C7B3D7F2A410C0BD8BBE9D5ED614A21DE18,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156858Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:43.242{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EDDA1A4590E8161D87D7EFBE7547F8B0,SHA256=3DFC7F205D77267C960D40CDEA31BA68A0440CB4DC57ABF132BCD4A92564CE34,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098619Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:43.391{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3A60571209084036C57F72BE0592CC9F,SHA256=BF5BF224B86F4C80DA4D7175794D89E073417E562D3DA7B73533C29293DC8A66,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156859Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:44.273{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FCCA71B90826A54E362A56D92271C957,SHA256=63DE9C77943400A882B50E51BCED2FC137061FC5F8A5A8B76D8A14CB28EC80F2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098620Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:44.392{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D67EA4DC2A32FA71C98EB078791BC83,SHA256=9D09C4B95F1669A404CC39C3258822D28CB11FEECB6BBEC3D8C6176B17D93A43,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098621Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:45.407{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=425EC376B4903900DF8651E3E046B192,SHA256=8F270AD16203E2ED3668DF90E14EDC9E9464931D050548DE9CC75D7DA4B614E2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156860Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:45.320{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A1D21AC153F7C527DD0DB2681ADD703,SHA256=743028DF9B735C5B3D38793A6D580DA60030988A26DA053416944B5439E8F1BA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156861Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:46.367{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5CAB9EF3CC26A7988DA3800085E9439B,SHA256=9842F0C2857CAC1CBE93308229877293AD81C7E881A0BDD36A556113EFFFEC91,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098622Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:46.408{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F72FE119317D7F2F5C00BFA55298C300,SHA256=BDCEB017F71BDECE4420B36783CCC1893BFB7F183AE44DFB9DC7A5DC7E622F20,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156862Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:47.382{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EBCA3504BDDE751BC49CE372EA6187DB,SHA256=102D98618AEA414805757AFB2D655E740FC94CA218AABB6B764C36A933BCA0A2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098636Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DBCF-60B9-8401-00000000C601}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098635Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098634Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098633Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098632Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098631Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098630Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098629Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098628Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098627Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098626Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DBCF-60B9-8401-00000000C601}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098625Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.517{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DBCF-60B9-8401-00000000C601}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098624Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.518{38D812B3-DBCF-60B9-8401-00000000C601}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098623Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:47.423{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5D9DFF693492BFAC107D2C7E0FD27143,SHA256=A062A860C944BABF5C10C0183108A3DD812AF47D32AEE70A2C1E3F19C9DE3F3F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156864Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:48.414{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6CBECA62515D9A149FB1793111362443,SHA256=6C4B1650E00806CB105705EFA7C7D7424F892E480355C1255D81D64C7570EF0F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098667Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DBD0-60B9-8601-00000000C601}2932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098666Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098665Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098664Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098663Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098662Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098661Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098660Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098659Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098658Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098657Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DBD0-60B9-8601-00000000C601}2932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098656Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.861{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DBD0-60B9-8601-00000000C601}2932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098655Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.862{38D812B3-DBD0-60B9-8601-00000000C601}2932C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098654Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.658{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=06DC605B9BC725408F62B11DAEF16473,SHA256=5C7AC51650B4FCA02127794A40B91DF8746C1D5C4E050F662A0AAA9357169B22,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098653Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.658{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EDDFA0445C740671A610406C433CBCC2,SHA256=75F65068D5C92F76FB2369CE3C7BA18C0F073D0B00A0132988047991664C2C6C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098652Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.658{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8687D1D8BA359EDAFF7D2681BEE2924F,SHA256=0ED4F1430D05D41EF1D3D76FF233C88666D022B0C33E7A49C02CC72CA580DA61,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098651Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:45.360{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50170-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x8000000000000000156863Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:45.422{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57991-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000098650Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.314{38D812B3-DBD0-60B9-8501-00000000C601}17642616C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098649Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DBD0-60B9-8501-00000000C601}1764C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098648Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098647Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098646Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098645Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098644Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098643Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098642Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098641Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098640Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098639Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DBD0-60B9-8501-00000000C601}1764C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098638Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.189{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DBD0-60B9-8501-00000000C601}1764C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098637Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:48.190{38D812B3-DBD0-60B9-8501-00000000C601}1764C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098668Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:49.705{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=695A350E185ADC05591B9142052EB32A,SHA256=0DE62871DF52349C812FF2E388CD0141BEA7FFD3967D0D6EFFA735602A8DF33A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156865Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:49.429{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1EA9BB6964EB1F90CD51C02A229A87D9,SHA256=3D5D7B480555BAE4489C57B3486109A1610FC34F7D02092174C80A0294E850D3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098670Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:50.846{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6808177F3C07727D2B7383A36A0BD846,SHA256=ACCC9CE54A82A0081E21841C9FD4BE2CF65931E58790BCE427095887DA706579,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156866Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:50.445{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A0448B3470FFFE61AF72BA8F898A7A7,SHA256=EF6BAE64476B55F2BEA1C41863F79C93A4BB3813BB01D142C5737517183EA10B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098669Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:50.018{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=06DC605B9BC725408F62B11DAEF16473,SHA256=5C7AC51650B4FCA02127794A40B91DF8746C1D5C4E050F662A0AAA9357169B22,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156867Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:51.445{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC8A6F7620DFDBD84EDCD51FDA0BAEC1,SHA256=104D4C1CC7D17CA64649941A38EA0DE74E4013C676674A5D5B666FF6AAE9A28D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098698Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.925{38D812B3-DBD3-60B9-8801-00000000C601}508920C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098697Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DBD3-60B9-8801-00000000C601}508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098696Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098695Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098694Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098693Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098692Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098691Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098690Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098689Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098688Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098687Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DBD3-60B9-8801-00000000C601}508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098686Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.768{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DBD3-60B9-8801-00000000C601}508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098685Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.769{38D812B3-DBD3-60B9-8801-00000000C601}508C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000098684Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.221{38D812B3-DBD3-60B9-8701-00000000C601}23162320C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098683Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DBD3-60B9-8701-00000000C601}2316C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098682Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098681Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098680Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098679Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098678Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098677Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098676Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098675Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098674Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098673Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DBD3-60B9-8701-00000000C601}2316C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098672Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.096{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DBD3-60B9-8701-00000000C601}2316C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098671Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.097{38D812B3-DBD3-60B9-8701-00000000C601}2316C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156868Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:52.508{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D19F92AFA0FF5ABE1739CB268E415D0,SHA256=ECC91418C2C9F16E135F8A1D88BE4DAFB37A4704AF9C1B4ED9A320706BDB6528,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098714Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.565{38D812B3-DBD4-60B9-8901-00000000C601}3562728C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098713Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=25367E65CB0A1B9875C990B746AEE16A,SHA256=6411EA50B415B42C86A2A8721B71FB09448D039BAFDFD8583B5B55A65ED91750,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098712Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C7015797F64E520149987BE39CDE6D3A,SHA256=1006A4F289AB083E00DE1FB84336AC74DE06A19CFC6857CDDED5725DCFB1B0DC,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098711Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DBD4-60B9-8901-00000000C601}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098710Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098709Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098708Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098707Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098706Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098705Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098704Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098703Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098702Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098701Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DBD4-60B9-8901-00000000C601}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098700Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.440{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DBD4-60B9-8901-00000000C601}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098699Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:52.441{38D812B3-DBD4-60B9-8901-00000000C601}356C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156869Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:53.509{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D55500AE10ADA7E2988C8EB62EE6BFC9,SHA256=DBA1877244E912048F698DDD02E35068DF0FF2FFD8D921305F4BAA95B20B9DB1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098716Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:53.679{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=AC6480BE2A2D03E62C89FC9409FCA528,SHA256=0BFCDC379495579DB7F7A8F507FDD2D8CC970DCF4AB6E693F9706BE0FCA1E314,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098715Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:53.456{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86CF24E6EE7243168B53EBDFA4770E1A,SHA256=7C2DEDF690A1CD91EE3E381A8200DC6FD0DEDF856BC5B3196A66611A52C829BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156871Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:54.521{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E51737BE47CC6B610DB052DF59C8711B,SHA256=D29BC5300BDAF98605ED5120BD34A1AFF0D6B3E0CFB8FAEE37A5AAF71365E4FC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098731Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.461{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0115DE9CA52AB74543315574EF4DE37,SHA256=8437095D9AC4E1D2C36CE6D74ABC22472D5BFC090AB1423C7DCB1267A47D6F26,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156870Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:51.453{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57992-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000098730Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:51.360{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50171-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000098729Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DBD6-60B9-8A01-00000000C601}1500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098728Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098727Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098726Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098725Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098724Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098723Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098722Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098721Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098720Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098719Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DBD6-60B9-8A01-00000000C601}1500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098718Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.085{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DBD6-60B9-8A01-00000000C601}1500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098717Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.086{38D812B3-DBD6-60B9-8A01-00000000C601}1500C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156872Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:55.525{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=549172898D8C9A7A6CF687DBE25274AF,SHA256=F34A1C76792F6FC4F0376EB2F85B6A02BDD163D419CA82B4D6D82A12ACE59752,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098734Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:55.461{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0EE133A60C8649163720C0733C7F69FE,SHA256=49DF5DD177A6812E4C9F6783E4C5CD575B57BEF9EA97EFC49A3C1C7D5070AEFA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098733Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:55.320{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=C0DB767A82FA0CA6D3D6A2C8793E8DB5,SHA256=A354FDB30D7A9F71616540E45F5084A64012B9ADB32CC2B6FAC5524CAB98AA18,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000098732Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:52:55.289{38D812B3-D3CA-60B9-1100-00000000C601}996C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d75916-0xa0d092ab) 23542300x8000000000000000156873Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:56.525{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6188CF067B244BE5F5E14D66664BCBB,SHA256=A53B8D36EFB6146188A6A79802D525A87E1D99364E682F6E9E1511D03A02445C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098735Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:56.475{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8CE7054B856BFC1E85F69879561AC794,SHA256=7CD4573922A2B8285D3526A1739EA00F88A848BC0F63B89752B2C65BD828D4CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156875Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:57.525{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DEF8ED12E89BAA6177587441DA7BC9E4,SHA256=27A9204C52A97407A2681293744079340E72D7E07B7C1F25938383A6BAAA4A8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098738Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:57.474{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7269E1364F82F00FEC770415FE7DFEE3,SHA256=B7C10F94F8C689078957FF7E7B9D9D3F5869DA89EC3A5A26BA081C644DA9280F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156874Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:54.515{27B03E6B-D3AA-60B9-1000-00000000C501}96C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudpfalsefalse10.0.1.14win-dc-819.attackrange.local123ntpfalse10.0.1.15ip-10-0-1-15.eu-central-1.compute.internal123ntp 354300x800000000000000098737Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.504{38D812B3-D3CA-60B9-1100-00000000C601}996C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.15win-host-926.attackrange.local123ntpfalse51.105.208.173-123ntp 354300x800000000000000098736Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:54.504{38D812B3-D3CA-60B9-1100-00000000C601}996C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.15win-host-926.attackrange.local123ntpfalse10.0.1.14-123ntp 23542300x8000000000000000156876Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:58.525{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6F26DCE8034E17B5E26367830524624,SHA256=79798AE93048F61AD593E02762E9DEAAB0A0BDD827FE9166DB7C8B57805EB0CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098739Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:58.472{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FD00157B279A438DC0347FCA13E44170,SHA256=7CE3E850727349F423611679BF4135A7BAB7F68D5E923EB3A50DFD4D1EAABA29,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156878Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:59.525{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E7F474E4FF8B8BB67CCEDCF13A418C2,SHA256=5CE715B4757708E653E022E0683133E0BF62A82E69F0006C832BA9FBC0997975,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098741Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:59.487{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C1D35F2BD203A1E2257C45261CD73D55,SHA256=3AF57BCB5B9AFABAE70B677BFD65F3729F9625581768ACC6D93357421152FBF7,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156877Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:52:56.626{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57993-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000098740Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:52:56.458{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50172-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156879Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:00.587{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5378638B8D8D8A975D0E8A2302D8CF12,SHA256=E2C1722F82DA4D4B81F38F3EE5FB6BE9EB6D08F0CB8B27384288B8EB1B352F5E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098742Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:00.517{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5A5FF5D6F1CA0E2EC39514CFE308ED6E,SHA256=C1EB85D68828E881F21D38C762809B4DAE2BC50B623F36DEDFD9BA4D28A295BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156880Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:01.603{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=302F8E000CCDAE214DBB8F452107924F,SHA256=D55E0762D446AA8C118C67D234DDF3A2C47FB77AD4F7E3F788B66194A8BB2E9C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098743Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:01.656{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=356C72B9D7DD353CF8DB354754DC0842,SHA256=CE9D14F6AC2819E4CEA259C9992D1EBA513F0F2CC0354CC247F40D1F2CBCA65A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098744Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:02.780{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA03FCEA59602F614140962253D74FCE,SHA256=91C9ADEC517DE3C29135B240A5CA41A2ADFE0379C2E1877704E1EC69C1817BE8,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000156882Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:53:02.681{27B03E6B-D3AA-60B9-1000-00000000C501}96C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d75916-0xa5388578) 23542300x8000000000000000156881Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:02.619{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C69A8A07CEAF74EA1F5EE65BB15C1F01,SHA256=6EBE8EBD817513848EC31AD6779BFEB78B8BA6D5AD1FCA08C466B529CF2ABA5A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156884Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:03.634{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68A2C153F73B304659ADF885B46BDBFE,SHA256=C6EC68FFDDEA47BDE1E6E32690AAC669BDBF2288BFE498FD07C0ED4D8BC853BB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098745Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:03.825{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11F8429C46D3F4FD83AAB4FDD9B2F68F,SHA256=AEC48C21AEC583B01D2623601201CA9350D57AE39C2FA3C0D9E2CFC95D98D822,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156883Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:03.197{27B03E6B-D3AA-60B9-1100-00000000C501}380NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=47E1CDA53E8798D96E1DE8534B00F81A,SHA256=7C6D2456DFFCF5C77B5DB4DF6BF4EE26D5D24A774518D2F24CFE559B5BBD043F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156887Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:04.853{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=619D06A645DCAFEDD5B777CD3E00FAC4,SHA256=CC03952EA3555FEF24783A9581F431A554922B636C2D9DF07A49CFDCA60B038E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098747Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:04.964{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B5ECF8F80A8874D0871E8F8955DC6D9,SHA256=FA23188D0BF69233FF034C986174874A59A0C50E9DB68D3AB5F39C1A86B3AE3C,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156886Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:02.063{27B03E6B-D3AA-60B9-1000-00000000C501}96C:\Windows\System32\svchost.exeNT AUTHORITY\LOCAL SERVICEudptruefalse10.0.1.14win-dc-819.attackrange.local123ntpfalse51.105.208.173-123ntp 354300x8000000000000000156885Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:01.626{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57994-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000098746Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:02.380{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50173-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156889Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:06.134{27B03E6B-D3BA-60B9-2A00-00000000C501}2856NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156888Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:06.103{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3907DF02C90B4F1E80BCD43F3A0C1F5D,SHA256=10DD22AF883159871B339EE21E3E5424CB21A0B8AAC024F0607BE31BE8F76604,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098748Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:06.025{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A7B364E36394A360FEDAF251C4AE1494,SHA256=B58996351E4D2CCACF658E30FF3D1BDF7470B7DBD0B4B8873E7AE9897524854A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156890Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:07.150{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=55F805C7C7D4F74F47622828F499932D,SHA256=19758F61C30DDD849C4CC889380EF8B00D4F1B81E744A41AAF3A7DB2CA997761,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098749Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:07.071{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6557A59B15D64F66E4A137CC8FEFAC4,SHA256=CB4FB6D4B3A9D815EBBCCD4DACAB7E4E78454A0A18542CF807A14CC9024296FA,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156892Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:05.517{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57995-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x8000000000000000156891Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:08.150{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB9255FC544BE15027DD158CA0E651D4,SHA256=8F0BE306597EFDD7091B90722F5EAF7535F8DC2F2E1CCF5A7C93CB884DC362A1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098750Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:08.070{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED0A2FB96294919D09B94B299C698E5C,SHA256=83BB775C09249BE1D264256FC15FB5A87C333B5CBB1E171A455F213B2B37D869,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156893Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:09.150{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=437045479FA9D7016F69E5E112217D4A,SHA256=355A501C230E192046FC7EBDD1DC52BC6458988C0D11B83298C64AC2600AFE99,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098751Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:09.116{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3F36633C4A985655B9E5437E94386CE1,SHA256=75A0E7A7B18A4209AD5518A922887DA70A08C7CD15C339077EE2248DBA01DB1F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098752Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:10.209{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=560537359A0B2BE875E7C12CFC1D382D,SHA256=C9C56FE9ECC6ECAD69D9C511489AB8F53135720ECD875DAA2D2A915E424D01E1,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156895Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:07.532{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57996-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156894Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:10.150{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F50D9BAE57BDB256C9EB2BBDED79BF4B,SHA256=6DEF9EC88B9E6743A2A905D419BF8AFE966852525C56331CE52C1B318676A47D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098754Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:11.382{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D9F047A245C55F8E9BF2B7713DBF65DD,SHA256=DEBB5692439D86F3ACE7429028919F23065F845BC5ED10BF7106BAB6F325AE52,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000156897Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:11.947{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\trial.lnk2021-06-04 07:53:11.947 23542300x8000000000000000156896Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:11.150{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=30FEE47326A12F59F4BE9855CCDD1BE6,SHA256=3887608282544769B4D469C15528F5BE78E4C1AA29D41AB94E36DE810AEEFEA3,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098753Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:07.505{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50174-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098755Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:12.570{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A6886FDE275DC17F32CEA00BAD228DC,SHA256=7250DC9A635AF37D50EB94E6547D0998D55BAC5AB97532C93CA6BEE9081D817B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000156903Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:12.275{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Local Disk (C).lnk2021-06-04 07:53:12.275 11241100x8000000000000000156902Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:12.275{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Temp.lnk2021-06-02 14:25:30.421 23542300x8000000000000000156901Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:12.275{27B03E6B-D625-60B9-F500-00000000C501}5024ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Temp.lnkMD5=F8F088CEC7A059E6FFDBBACF81EC8930,SHA256=5B16215E675AC73F476F96C6861B68D53865D7536A005473BD2A6B90CAF8C04B,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000156900Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:12.275{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Temp.lnk2021-06-02 14:25:30.421 23542300x8000000000000000156899Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:12.275{27B03E6B-D625-60B9-F500-00000000C501}5024ATTACKRANGE\AdministratorC:\Windows\Explorer.EXEC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\Temp.lnkMD5=E400ABFAFCDF5D66F27C8923BC26CBE0,SHA256=A41776437ED8318268C998626E91EEAC518235F41262A8D6A1FDFF5F1DB950A3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156898Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:12.181{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E6F627927FF1A1D46AFC415E0E387CF,SHA256=15B27B5BA16C0A388EBFC154755AEC6494C3BD1B5964DAF3C342DAEA66C86B41,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098756Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:13.594{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C5D8D04DDF9751D1B5FAB78AA9A2C582,SHA256=AF2CEC39BA2185DB80F5F56E6662191167E89D16758687EC9491BF4AD46068BC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156904Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:13.213{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA8B179A5A0DFFD4818135E437704562,SHA256=3F1D2F2A3B32BB5B695CB93B2545DD28BBF88A2158DE5F39FB9394327FB53284,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098757Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:14.593{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=726BF8586C0E0A7B3B79283B2629FD94,SHA256=F7FE9CDB4544ACA51C1A31B472C0691D70120418DDD0833BD8232C009EFB580B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156905Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:14.432{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A20CE198A012850456DC8E99DDCA6959,SHA256=973CC0837FDBB562FBF76279F16CAD020990247EB311F6E133F46017BCC1C876,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156907Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:13.439{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57997-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156906Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:15.447{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16AC88C889EF76BC0AC71F38D3BDE607,SHA256=FF5BACE018E3D5D15D2B3FEE261C789B23E5133D92E2DE43FB894D16127B9E50,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098759Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:15.607{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F8660B0AE94340C291465F8C4DD7909E,SHA256=69C58947CA43C04D6B7BCAEA74C788450EBBF303753F9E612A41AAF8B169B497,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098758Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:13.410{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50175-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000156910Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:16.463{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19C8CB93A5E31576128AEE2320E88BED,SHA256=3DC014F31BD45BE8C8776F3648B9C9B214437459DB1A5255C1B549EBAA53E7DC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098760Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:16.606{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D0234D791F3AA2F2A7AD9B3D8146C1B,SHA256=449E0918996DB7C59281626C5AC60B119AEE65753EAAE1C7ED904813F397EB9D,IMPHASH=00000000000000000000000000000000falsetrue 11241100x8000000000000000156909Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:16.307{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXEC:\Temp\trial\terraform_1519339429.cmd2021-06-04 07:53:16.307 10341000x8000000000000000156908Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:16.244{27B03E6B-D624-60B9-EE00-00000000C501}45404648C:\Windows\system32\taskhostw.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d832|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098761Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:17.605{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4FB709EBAE09D55043B69AA4C9AE397E,SHA256=10A37F36ADBCD078F558202945B136B03D46D99849CBE1FC847FC987E86EBCFE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156911Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:17.572{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=848336F15BE746F2EF1DD939E83D8037,SHA256=CC148480262A8D4F519CEFB6B4548199A9A20D20E1A03A2F8BEA602A8CA3D62F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098762Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:18.604{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6FC7CEFBD6375D1EC5DB47A5A577EC7B,SHA256=88D25B4B5A90F1CA4B71D178DC76E629EFFEF0D936181AEBF550AE2CEE532CBD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156912Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:18.572{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD7408098E166AE0D10C6923C6408B85,SHA256=E6A34BF35F2BC045A3BDA61D03E8846F102BDC8E541B7A9C726C309E11632276,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156913Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:19.588{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F027902787C3BF8B8C6A39A34B6E734F,SHA256=53CDC7E6DDA99AD7907EF096A2CEF95DFB507BC0593D4848F866EFA6EC79BA8A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098763Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:19.619{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=03961CFCCFDCED8772514254D725269C,SHA256=0AF03CF9CBA04993E0367BDB91EB5C88283A4181E0E841EE602F720BAC747373,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156915Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:20.588{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B3907381AEDA9EE8EAB43A27A675D747,SHA256=A083EC3691F166D060496EE68477121865350FA03558A9755E6AD8462EBD89EC,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156914Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:18.548{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57998-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098764Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:20.618{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=39C029C059A31AC6205165B57A56DA75,SHA256=F1ED44874AE2F28B7D528E9F3691A0551261AD8223B8C69375D1120439F80CEB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098765Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:21.616{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6AB9D7BD3AD60E50E7FC320374348A3,SHA256=C7FB002F4D96FF783AE8C1E9542BF8BA6089CAE04506EBBA45873BDD72899D55,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156916Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:21.641{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E622546DBA51A7A1584C374503AF73ED,SHA256=108EEFD99B8D7E75661389243B9F577A63A93EBF568739DA6328FF1192EBF5BD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098768Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:22.631{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=11B99D4233BE16B94FCD902815E3A7DD,SHA256=59670C51BB498423E92791594682A9068E1B5156CB0613AED4EE8B34B6426754,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156951Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.705{27B03E6B-D624-60B9-EA00-00000000C501}44004428C:\Windows\System32\RuntimeBroker.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+61c8b|C:\Windows\system32\windows.cortana.Desktop.dll+418c2|C:\Windows\system32\windows.cortana.Desktop.dll+41968|C:\Windows\system32\windows.cortana.Desktop.dll+16557|C:\Windows\system32\windows.cortana.Desktop.dll+12d9b|C:\Windows\system32\windows.cortana.Desktop.dll+15c7|C:\Windows\system32\windows.cortana.Desktop.dll+44bd|C:\Windows\System32\combase.dll+ae6fa|C:\Windows\System32\combase.dll+a54bd|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+64de3|C:\Windows\System32\combase.dll+64a92|C:\Windows\System32\combase.dll+633a8|C:\Windows\System32\combase.dll+6112d|C:\Windows\System32\combase.dll+6080f|C:\Windows\System32\combase.dll+7bfe9|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x8000000000000000156950Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.705{27B03E6B-D624-60B9-EA00-00000000C501}44004428C:\Windows\System32\RuntimeBroker.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+61c8b|C:\Windows\system32\windows.cortana.Desktop.dll+418c2|C:\Windows\system32\windows.cortana.Desktop.dll+41680|C:\Windows\system32\windows.cortana.Desktop.dll+92dc|C:\Windows\system32\windows.cortana.Desktop.dll+12d31|C:\Windows\system32\windows.cortana.Desktop.dll+15c7|C:\Windows\system32\windows.cortana.Desktop.dll+44bd|C:\Windows\System32\combase.dll+ae6fa|C:\Windows\System32\combase.dll+a54bd|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+64de3|C:\Windows\System32\combase.dll+64a92|C:\Windows\System32\combase.dll+633a8|C:\Windows\System32\combase.dll+6112d|C:\Windows\System32\combase.dll+6080f|C:\Windows\System32\combase.dll+7bfe9|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x8000000000000000156949Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.705{27B03E6B-D625-60B9-F500-00000000C501}50244528C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+109196|C:\Windows\System32\TwinUI.dll+82af7|C:\Windows\System32\TwinUI.dll+beb2e|C:\Windows\System32\TwinUI.dll+beaf9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156948Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.705{27B03E6B-D625-60B9-F500-00000000C501}50244528C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+109196|C:\Windows\System32\TwinUI.dll+82af7|C:\Windows\System32\TwinUI.dll+beb2e|C:\Windows\System32\TwinUI.dll+beaf9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156947Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.672{27B03E6B-D624-60B9-EA00-00000000C501}44004428C:\Windows\System32\RuntimeBroker.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+61c8b|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+1a962|C:\Windows\system32\windows.cortana.onecore.dll+16e12|C:\Windows\system32\windows.cortana.onecore.dll+16d5b|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+ae6fa|C:\Windows\System32\combase.dll+a54bd|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+64de3|C:\Windows\System32\combase.dll+64a92|C:\Windows\System32\combase.dll+633a8|C:\Windows\System32\combase.dll+6112d|C:\Windows\System32\combase.dll+6080f|C:\Windows\System32\combase.dll+7bfe9|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d 10341000x8000000000000000156946Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.672{27B03E6B-D624-60B9-EA00-00000000C501}44004428C:\Windows\System32\RuntimeBroker.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\System32\combase.dll+61c8b|C:\Windows\system32\windows.cortana.onecore.dll+1a8c3|C:\Windows\system32\windows.cortana.onecore.dll+6198|C:\Windows\system32\windows.cortana.onecore.dll+16cb1|C:\Windows\system32\windows.cortana.onecore.dll+1537|C:\Windows\system32\windows.cortana.onecore.dll+4a2d|C:\Windows\System32\combase.dll+ae6fa|C:\Windows\System32\combase.dll+a54bd|C:\Windows\System32\RuntimeBroker.exe+12d1|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27cf|C:\Windows\System32\combase.dll+64de3|C:\Windows\System32\combase.dll+64a92|C:\Windows\System32\combase.dll+633a8|C:\Windows\System32\combase.dll+6112d|C:\Windows\System32\combase.dll+6080f|C:\Windows\System32\combase.dll+7bfe9|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde 10341000x8000000000000000156945Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.656{27B03E6B-D625-60B9-F500-00000000C501}5024932C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+ba300|C:\Windows\System32\TwinUI.dll+ba677|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+64ddc|C:\Windows\System32\combase.dll+64a92|C:\Windows\System32\combase.dll+633a8|C:\Windows\System32\combase.dll+6180f|C:\Windows\System32\combase.dll+6080f|C:\Windows\System32\combase.dll+5df06|C:\Windows\System32\combase.dll+5d6ba|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x8000000000000000156944Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.656{27B03E6B-D625-60B9-F500-00000000C501}5024932C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+ba300|C:\Windows\System32\TwinUI.dll+ba677|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+64ddc|C:\Windows\System32\combase.dll+64a92|C:\Windows\System32\combase.dll+633a8|C:\Windows\System32\combase.dll+6180f|C:\Windows\System32\combase.dll+6080f|C:\Windows\System32\combase.dll+5df06|C:\Windows\System32\combase.dll+5d6ba|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x8000000000000000156943Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.656{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b3175|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156942Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.656{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b308e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156941Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.656{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b3057|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156940Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.641{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB5357A9A3F2DDE1320E2F2A694C2463,SHA256=5CB3E8FE93BA03DF4E9A224A8ECA053639F6EF18409B50F698195DE85277F016,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098767Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:22.163{38D812B3-D3CB-60B9-1C00-00000000C601}1936NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098766Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:19.332{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50176-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x8000000000000000156939Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:20.644{27B03E6B-D3BB-60B9-3900-00000000C501}3336C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58002-false169.254.169.254-80http 354300x8000000000000000156938Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:20.552{27B03E6B-D3BB-60B9-3900-00000000C501}3336C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58001-false169.254.169.254-80http 354300x8000000000000000156937Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:20.520{27B03E6B-D3BB-60B9-3900-00000000C501}3336C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58000-false169.254.169.254-80http 354300x8000000000000000156936Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:20.519{27B03E6B-D3BB-60B9-3900-00000000C501}3336C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local57999-false169.254.169.254-80http 10341000x8000000000000000156935Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156934Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0D00-00000000C501}896944C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+1644|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156933Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0D00-00000000C501}896944C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+1644|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156932Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0D00-00000000C501}896944C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+1644|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156931Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0D00-00000000C501}896944C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+1644|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156930Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0D00-00000000C501}896944C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+1644|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156929Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0D00-00000000C501}896944C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+1644|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156928Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156927Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a384|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156926Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+489d|C:\Windows\SYSTEM32\psmserviceexthost.dll+1a2ed|C:\Windows\SYSTEM32\psmserviceexthost.dll+11055|C:\Windows\SYSTEM32\psmserviceexthost.dll+108cf|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156925Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156924Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156923Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156922Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D625-60B9-F500-00000000C501}50241564C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+12d319|C:\Windows\System32\TwinUI.dll+12dfcf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156921Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D625-60B9-F500-00000000C501}50244104C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+109196|C:\Windows\System32\TwinUI.dll+82af7|C:\Windows\System32\TwinUI.dll+beb2e|C:\Windows\System32\TwinUI.dll+beaf9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156920Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D625-60B9-F500-00000000C501}50244104C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+109196|C:\Windows\System32\TwinUI.dll+82af7|C:\Windows\System32\TwinUI.dll+beb2e|C:\Windows\System32\TwinUI.dll+beaf9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156919Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.625{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156918Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.609{27B03E6B-D625-60B9-F500-00000000C501}5024932C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+57c95|C:\Windows\System32\TwinUI.dll+37528|C:\Windows\System32\TwinUI.dll+37448|C:\Windows\System32\TwinUI.dll+38893|C:\Windows\System32\TwinUI.dll+36e6d|C:\Windows\System32\TwinUI.dll+36c71|C:\Windows\System32\TwinUI.dll+10928d|C:\Windows\System32\TwinUI.dll+d211f|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+c6ae|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156917Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:22.609{27B03E6B-D625-60B9-F500-00000000C501}5024932C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+57c95|C:\Windows\System32\TwinUI.dll+37590|C:\Windows\System32\TwinUI.dll+37435|C:\Windows\System32\TwinUI.dll+38893|C:\Windows\System32\TwinUI.dll+36e6d|C:\Windows\System32\TwinUI.dll+36c71|C:\Windows\System32\TwinUI.dll+10928d|C:\Windows\System32\TwinUI.dll+d211f|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+c6ae|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098769Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:23.755{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2FEA0145596E75721A7E0CC8C9B42303,SHA256=B246C0D36FD2DAD79567E739F785FE247362CDC0D0A2012147D52CF3850B2C0C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156959Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:23.922{27B03E6B-D625-60B9-F500-00000000C501}5024932C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+ba300|C:\Windows\System32\TwinUI.dll+ba677|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+64ddc|C:\Windows\System32\combase.dll+64a92|C:\Windows\System32\combase.dll+633a8|C:\Windows\System32\combase.dll+6180f|C:\Windows\System32\combase.dll+6080f|C:\Windows\System32\combase.dll+5df06|C:\Windows\System32\combase.dll+5d6ba|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x8000000000000000156958Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:23.922{27B03E6B-D625-60B9-F500-00000000C501}5024932C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+ba300|C:\Windows\System32\TwinUI.dll+ba677|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+618a9|C:\Windows\System32\combase.dll+27a9|C:\Windows\System32\RPCRT4.dll+62d9b|C:\Windows\System32\combase.dll+64ddc|C:\Windows\System32\combase.dll+64a92|C:\Windows\System32\combase.dll+633a8|C:\Windows\System32\combase.dll+6180f|C:\Windows\System32\combase.dll+6080f|C:\Windows\System32\combase.dll+5df06|C:\Windows\System32\combase.dll+5d6ba|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11b2c|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+5be0|C:\Windows\System32\windows.immersiveshell.serviceprovider.dll+635e 10341000x8000000000000000156957Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:23.906{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156956Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:23.906{27B03E6B-D625-60B9-F500-00000000C501}50243008C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1ea06|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+109196|C:\Windows\System32\TwinUI.dll+82af7|C:\Windows\System32\TwinUI.dll+beb2e|C:\Windows\System32\TwinUI.dll+beaf9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156955Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:23.906{27B03E6B-D625-60B9-F500-00000000C501}50243008C:\Windows\Explorer.EXE{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e95e|C:\Windows\SYSTEM32\twinapi.appcore.dll+1e3d1|C:\Windows\SYSTEM32\twinapi.appcore.dll+1dbcc|C:\Windows\SYSTEM32\twinapi.appcore.dll+1d777|C:\Windows\System32\TwinUI.dll+109196|C:\Windows\System32\TwinUI.dll+82af7|C:\Windows\System32\TwinUI.dll+beb2e|C:\Windows\System32\TwinUI.dll+beaf9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156954Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:23.906{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156953Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:23.891{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3200C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+739b|C:\Windows\SYSTEM32\psmserviceexthost.dll+ae34|C:\Windows\SYSTEM32\psmserviceexthost.dll+7bae|C:\Windows\SYSTEM32\psmserviceexthost.dll+12141|C:\Windows\SYSTEM32\psmserviceexthost.dll+170e8|C:\Windows\SYSTEM32\resourcepolicyserver.dll+12326|C:\Windows\SYSTEM32\resourcepolicyserver.dll+bac5|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000156952Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:23.641{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6812860266EAE6794C843F22F3C371DB,SHA256=DD33021F16B59587A4E5CCEE1BB890906F033BA06320ED7BC8BA7CAF4888753A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098771Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:24.988{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C6CAC314E20FDCD650D97AE60C6D2B4,SHA256=9F18E38E417BAECD7C7F851FCED700A5FC624B4366B8A1CA04D9782E7C843DAA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156960Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:24.656{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B851B2922527CB34E3D42677258D581A,SHA256=1103892EE3C2020E0D7C0D535BA9AECDCEEF41CC8925682DC36345B9E3B82670,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098770Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:21.410{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50177-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x8000000000000000156961Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:25.672{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1C37C8BFB757E1ED8DE846E90DD5084,SHA256=C72B147B6323DAE5ABD9D369A1A4E72BF95E869CC55C80661C8F4173F124AE1F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156962Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:26.813{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=33D9D9F9575817C2A4127EACD8824927,SHA256=A61C1DF82BBDEA885C777040D03DB70CD3CAC4659BA0D05298F66D143BF78B78,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098772Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:26.221{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=43EA28A945CF4A34665F7D07A4D3CC20,SHA256=A3E7D12A3DE4E60FCA3FB0539FB4945AEA1C85BA509FEF794F9E857BF3E11C02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098774Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:27.408{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE1E593D2E93BD5CD780174449EF9A94,SHA256=320F8276D77A1699C829808A4260E245AC73A59CD7639035647A1D70CE1A4173,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098773Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:24.441{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50178-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x8000000000000000156963Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:24.523{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58003-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098775Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:28.485{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A4C0CCFD28C731C3E2F36086B5E0DC7D,SHA256=C02199EF456FC140B1723C6AA1332A5AFC8D15A1CF0D78892C8B5C317CAF9199,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156964Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:28.032{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D403E1C59A7910EE95EA6973E5099B2A,SHA256=D9FAA71D0EBE62127926994A849C8190C59095F310E4120D656E7957DFA219A1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098776Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:29.640{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA1C5B5C1B1A63E314509D5CB502862B,SHA256=737B78FA5AEFF7D29772CC059FDECC06E8E6D820637426B334603F7BFF4B1452,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156974Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.203{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156973Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.203{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156972Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.203{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156971Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.203{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156970Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.203{27B03E6B-D3A9-60B9-0C00-00000000C501}836864C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156969Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.203{27B03E6B-D624-60B9-EB00-00000000C501}44845532C:\Windows\system32\sihost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\SYSTEM32\usermgrcli.dll+1121|C:\Windows\System32\modernexecserver.dll+37dac|C:\Windows\System32\modernexecserver.dll+37d4f|C:\Windows\System32\modernexecserver.dll+375a6|C:\Windows\System32\modernexecserver.dll+1a1c4|C:\Windows\System32\modernexecserver.dll+3191d|C:\Windows\System32\modernexecserver.dll+32871|C:\Windows\System32\modernexecserver.dll+3278f|C:\Windows\SYSTEM32\ntdll.dll+2063e|C:\Windows\SYSTEM32\ntdll.dll+1e854|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156968Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.188{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+78b1|C:\Windows\SYSTEM32\psmserviceexthost.dll+74d7|C:\Windows\SYSTEM32\psmserviceexthost.dll+12fce|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156967Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.188{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 10341000x8000000000000000156966Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.188{27B03E6B-D3A9-60B9-0C00-00000000C501}8365192C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F700-00000000C501}4620C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe0x3600C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\psmserviceexthost.dll+966a|C:\Windows\SYSTEM32\psmserviceexthost.dll+776e|C:\Windows\SYSTEM32\psmserviceexthost.dll+12f1c|C:\Windows\SYSTEM32\psmserviceexthost.dll+15b2b|C:\Windows\SYSTEM32\psmserviceexthost.dll+1011d|C:\Windows\SYSTEM32\psmserviceexthost.dll+104a0|C:\Windows\SYSTEM32\psmserviceexthost.dll+13952|C:\Windows\SYSTEM32\psmserviceexthost.dll+16139|C:\Windows\SYSTEM32\psmserviceexthost.dll+16c03|C:\Windows\SYSTEM32\resourcepolicyserver.dll+1a70e|C:\Windows\SYSTEM32\resourcepolicyserver.dll+14fc2|C:\Windows\SYSTEM32\resourcepolicyserver.dll+c61d|C:\Windows\SYSTEM32\resourcepolicyserver.dll+118d9|C:\Windows\SYSTEM32\resourcepolicyserver.dll+b91a|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c 23542300x8000000000000000156965Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.063{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=839EEC11DD6CC293610125388D551DF6,SHA256=89D639DA7F84C3D446A5B158625240CA1005B8F8CB6F9D39132E84629A2D5B4B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098777Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:30.639{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1779FA7875E2A9FB42E0F823C435FB91,SHA256=CF4EBBC31536C238D4DA1D81F850785C54FC68C413082DB10DCF0CA1DEDADB0F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156975Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:30.078{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86A494F5E7D0C2837B3593DD1E603E7C,SHA256=172774508970170E8F50A2E9D393986A0611BB9C15FA1129C9A2A8C05545FCFB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098778Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:31.653{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73125E294AE2D8AC90F483AE0F5C9395,SHA256=382BF3B533D1BBEE7A116A4DEFF56A27CD2463206BDE60A0584B574F0CA9A78A,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000156985Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:29.523{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58004-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000156984Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.704{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBFB-60B9-AE01-00000000C501}5980C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156983Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.704{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156982Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.704{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156981Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.704{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156980Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.704{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156979Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.704{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DBFB-60B9-AE01-00000000C501}5980C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156978Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.704{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBFB-60B9-AE01-00000000C501}5980C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156977Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.704{27B03E6B-DBFB-60B9-AE01-00000000C501}5980C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156976Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.125{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A6D77EA29361D0ABE4D69ACC0771F32E,SHA256=E43AE4CDAEFBA68F5F59A4863F517612A73D642B21293882760FC8DF64D4AAB9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098779Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:32.668{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=851328231F8132ABA9E3886311001F20,SHA256=92E5CDB1DEEB8B695C59C5C1690EEF85D1B0732CCFA6476772B84A17E410A8BD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000156997Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.954{27B03E6B-DBFC-60B9-AF01-00000000C501}6965432C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156996Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.766{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBFC-60B9-AF01-00000000C501}696C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156995Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.766{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156994Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.766{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156993Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.766{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156992Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.766{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000156991Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.766{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DBFC-60B9-AF01-00000000C501}696C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000156990Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.766{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBFC-60B9-AF01-00000000C501}696C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156989Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.767{27B03E6B-DBFC-60B9-AF01-00000000C501}696C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156988Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.735{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8FF25EC318C2F7F5E2E110CE8AC65621,SHA256=8B35100CD8F26405E605560E59FDE23ED05B15B666D43809F30DA48E60FA44C9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156987Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.735{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=9BEA03CD3F09040ED7040908E127C529,SHA256=E63EE6D9268288B4021060E81DD4CF9E7A63C701DEB21D100B2D6AE26C30211E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000156986Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:32.141{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5952F472F560AD5435597EE986EA967E,SHA256=BCE99888F157A7212A00B65B3690B58310BDC32F4ECFA1EDD220437887F0F54D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098781Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:30.395{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50179-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098780Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:33.669{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69BEC8139B6A9E87B295752E1D567AC2,SHA256=486C712AC81492A79998B17D6D37876182C3ED0429748009A84DD67D7395FCE4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157009Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.985{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8FF25EC318C2F7F5E2E110CE8AC65621,SHA256=8B35100CD8F26405E605560E59FDE23ED05B15B666D43809F30DA48E60FA44C9,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157008Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.851{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58005-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 354300x8000000000000000157007Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:31.851{27B03E6B-D3BA-60B9-2600-00000000C501}2784C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58005-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 10341000x8000000000000000157006Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.391{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBFD-60B9-B001-00000000C501}5380C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157005Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.391{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157004Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.391{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157003Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.391{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157002Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.391{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157001Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.391{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DBFD-60B9-B001-00000000C501}5380C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157000Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.391{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBFD-60B9-B001-00000000C501}5380C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000156999Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.393{27B03E6B-DBFD-60B9-B001-00000000C501}5380C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000156998Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:33.157{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7AEBFF33B9AA860282B6DFC0015A6A32,SHA256=67A06C514812DC9EC9010501E33D2E38B4BFD75959B4FEB8771685C0A8ACC104,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098782Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:34.684{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B4BA444096E6959BCAE51914B99DDAFB,SHA256=2878EF97DCE5D56015E0BA9FF675B8462546C6A5FFAA938B9683C90A9C50526A,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000157013Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:53:34.688{27B03E6B-D3BA-60B9-2300-00000000C501}2740C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Volumes\D370F6FF-0000-0000-0000-100000000000\Volume Configuration File\\.\C:\System Volume Information\DFSR\Config\Volume_D370F6FF-0000-0000-0000-100000000000.XML 13241300x8000000000000000157012Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:53:34.672{27B03E6B-D3BA-60B9-2300-00000000C501}2740C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\5B72E8AA-F40B-44DB-868D-DEBEB9867A10\Config SourceDWORD (0x00000001) 13241300x8000000000000000157011Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:53:34.672{27B03E6B-D3BA-60B9-2300-00000000C501}2740C:\Windows\system32\DFSRs.exeHKLM\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\5B72E8AA-F40B-44DB-868D-DEBEB9867A10\Replica Set Configuration File\\?\C:\System Volume Information\DFSR\Config\Replica_5B72E8AA-F40B-44DB-868D-DEBEB9867A10.XML 23542300x8000000000000000157010Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:34.172{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88A0B3A2C5D43D5FFCA8AC5D3B35F5B0,SHA256=B0C5527FADBD1EE46DCC19005D84C1E23A8EC8D9D80EF9D7D5D73175CE51AA5D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098784Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:35.683{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=93336AF4DEE82899EFC5C1338C546F59,SHA256=36B64F2BDF77CF3B126C04779E8CDDB0689186710924FED8DA7146B6E196B87F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157032Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.985{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBFF-60B9-B201-00000000C501}6100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157031Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.985{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157030Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.985{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157029Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.985{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157028Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.985{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157027Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.985{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DBFF-60B9-B201-00000000C501}6100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157026Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.985{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBFF-60B9-B201-00000000C501}6100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157025Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.986{27B03E6B-DBFF-60B9-B201-00000000C501}6100C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157024Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.688{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=061A26FA4598CE1E97749119275FA76E,SHA256=371A394AAFBBA6B35296660B118760AF820C8F8E7B977AFD90BF6EC2B8418F4F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157023Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.485{27B03E6B-DBFF-60B9-B101-00000000C501}41202544C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157022Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.313{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DBFF-60B9-B101-00000000C501}4120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157021Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.313{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157020Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.313{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157019Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.313{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157018Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.313{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157017Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.313{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DBFF-60B9-B101-00000000C501}4120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157016Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.313{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DBFF-60B9-B101-00000000C501}4120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157015Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.314{27B03E6B-DBFF-60B9-B101-00000000C501}4120C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157014Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:35.219{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A555BFC0539CF15B8010872D64468009,SHA256=881C0AAD1C747F06D68A300887A757C0F6F89E80F6EBD8087DCE52AF7D808D3E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098783Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:35.636{38D812B3-D3CA-60B9-1300-00000000C601}96NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=3CF8B403DA7DC53B6F86CFF8F81CB93C,SHA256=3BC5DA81292A5130EB67743B4CBD9C3A2A383733DD15BB67F99132463A26E9D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098785Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:36.682{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=42B8E430817AE90CCF805C504E88825A,SHA256=D4DAF0D8B20606D543D561D7FE97C0C70538D6779A171C9EF10A2090D524BFC4,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157044Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.923{27B03E6B-D624-60B9-EE00-00000000C501}45404648C:\Windows\system32\taskhostw.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d832|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157043Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.876{27B03E6B-DC00-60B9-B301-00000000C501}42764472C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157042Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.657{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC00-60B9-B301-00000000C501}4276C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157041Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.657{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157040Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.657{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157039Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.657{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157038Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.657{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157037Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.657{27B03E6B-D3A7-60B9-0500-00000000C501}4202108C:\Windows\system32\csrss.exe{27B03E6B-DC00-60B9-B301-00000000C501}4276C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157036Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.657{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC00-60B9-B301-00000000C501}4276C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157035Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.658{27B03E6B-DC00-60B9-B301-00000000C501}4276C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157034Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.235{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8057BF363AD2D19B73473A066052CE0D,SHA256=F35D22D7F972A1AC6B66DB88E383B380965215F9592A439043E176B950DAE27A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157033Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:36.157{27B03E6B-DBFF-60B9-B201-00000000C501}61001276C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098786Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:37.682{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=66BA897BC35E2BEDD5D265472B0D470E,SHA256=A8CFFBB354F29992949A1633FA9ABFFCDE8DE412753B1103D17D1661B7293D59,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157053Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:37.251{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9455B5224B3DBF7D6723627F2417B0C0,SHA256=B1511BE0E8B8F34884DC0344FD225843CDFEB1A52DB194B2506E7778A1598075,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157052Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:34.570{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58009-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x8000000000000000157051Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:34.107{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58008-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 354300x8000000000000000157050Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:34.107{27B03E6B-D3BA-60B9-2300-00000000C501}2740C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58008-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 354300x8000000000000000157049Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:34.096{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58007-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 354300x8000000000000000157048Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:34.096{27B03E6B-D3BA-60B9-2300-00000000C501}2740C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58007-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 354300x8000000000000000157047Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:34.071{27B03E6B-D3A9-60B9-0D00-00000000C501}896C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58006-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local135epmap 354300x8000000000000000157046Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:34.071{27B03E6B-D3BA-60B9-2300-00000000C501}2740C:\Windows\System32\dfsrs.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58006-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local135epmap 23542300x8000000000000000157045Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:37.032{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2B7EBF79E3A927251951D4FA9E1E3123,SHA256=8012A3CFDE8E69C6E18B5BF9257B60A0344CA81961C77A96A7F576BF6A2D20A6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098788Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:35.506{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50180-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098787Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:38.689{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E8058D5148A58228C48C902EF929EC7B,SHA256=AB784755B6CDF60EB2AC148E186023F05EB8DACDD2651C8BE67A617CF634DF6D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157062Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:38.485{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC02-60B9-B401-00000000C501}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157061Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:38.485{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157060Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:38.485{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157059Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:38.485{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157058Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:38.485{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157057Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:38.485{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DC02-60B9-B401-00000000C501}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157056Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:38.485{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC02-60B9-B401-00000000C501}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157055Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:38.486{27B03E6B-DC02-60B9-B401-00000000C501}4144C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157054Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:38.266{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=89A94806E71E056C5654B216B28173C7,SHA256=3D89D875E3577800AE30471CB8775B86BE32DC818E984205B7D91253E73BCD6C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098789Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:39.689{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C340F32308EEC9C26C5C4F6595FE474,SHA256=37FA331C5962DE779517F34A23EC8AD2BAAD39C94A838051F866032E09F02235,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157064Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:39.501{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=6F044EA8554534769F670B4E1B611C84,SHA256=A9736A02D1641A3FFA015962A2CF2B4A7C025685A368EA44A1D537D574A49156,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157063Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:39.266{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B689205313DACB0BEE23AD0BB305306,SHA256=DDA1CFFB472F756821AFB35DE0A06E0CB94212881FEA3787625A8AF0C54168CC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157065Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:40.438{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE93420D0685B26C30990C8DAFCDEEB2,SHA256=45C2B1D9D8C126954E06733A83BBB8A18596B3247587CD241B2ADA773A7039E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098794Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:40.688{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6698B253EDFAA60EB3EA85F51AD209F0,SHA256=C16685AEF2B5B57D41E5E30B1C24BF4DD369FDAA181F7D6D4DEF860FAAFF2580,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098793Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:37.183{38D812B3-D3CC-60B9-3400-00000000C601}1728C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50184-false169.254.169.254instance-data.eu-central-1.compute.internal80http 354300x800000000000000098792Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:37.067{38D812B3-D3CC-60B9-3400-00000000C601}1728C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50183-false169.254.169.254instance-data.eu-central-1.compute.internal80http 354300x800000000000000098791Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:37.024{38D812B3-D3CC-60B9-3400-00000000C601}1728C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50182-false169.254.169.254instance-data.eu-central-1.compute.internal80http 354300x800000000000000098790Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:37.023{38D812B3-D3CC-60B9-3400-00000000C601}1728C:\Program Files\Amazon\SSM\ssm-agent-worker.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50181-false169.254.169.254instance-data.eu-central-1.compute.internal80http 23542300x800000000000000098795Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:41.719{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF210C6C117BB2BAF4F637ED01859B57,SHA256=BF82FE936036E3C174D0E75D1A7B8F4212FDF7D70D31CBBDCE44698016C7B474,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157066Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:41.454{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3B82BC8C8C41F85A02F86295CFD652D,SHA256=FF2264753A42B7951A59963674DDB7D38DA596027BA3EDA88675EC7320DD51FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098796Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:42.811{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9FB440AF97FF81FCC4731A13FDF9C375,SHA256=0A9329DE809C7F61BF0108F21751E3CE3B1F06CFA5187ED9E4B1842CA0FB5761,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157068Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:40.585{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58010-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157067Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:42.501{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED66D16B8D751B1D29A629FCCB8C1ED1,SHA256=0A37CA4FA3CE6F0868F6A20F742DD3A2E30035C775BE829A2D41B9CE87B0DF7A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098797Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:43.967{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AE8EEE485DB1426666A10D90A2808101,SHA256=645A906C0052586425ABAD1B686E7D5944E11A0396AC46474BB2BEBDB2F05E6B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157069Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:43.517{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2D9092481F47138DB70B0902608D7D15,SHA256=5C928FAC85AA1D8B8F802B96C25023064E23685432CBBC0EA15AC0621E9D2609,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157070Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:44.563{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC28BDC51046DF5C0D2DDC5CF5791A60,SHA256=E48113869DAC832CF1D2E200E755D1F6CCB070EE441499C383D83EBB286FA492,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098798Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:41.375{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50185-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157071Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:45.579{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84D279702499261B011F3DE2B6687DD1,SHA256=B54718E664E0EF9F957B3BDE91088C3DC1CE4542FB4DA2D3BE83705AF2BC38DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098799Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:45.184{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A39D2644D41CE9F12FC4CD398C1BEDF,SHA256=75E0C6A854D1F2ABB4965F56B9773862DBBD7C533330AA4B5BDB51B8BB4CFACF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157072Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:46.579{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BAEE63EF0BBE57AA2C8945FEE17A7175,SHA256=A5ABD9DC03AF5117BE21100EB01D7DDD396E064FF4AC21B593302889A8462709,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098800Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:46.246{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ADAF5469497E0917C07B28F39043894F,SHA256=89306E1B1BF31181395C65994611C1603220ACBB8E0E159D02FA22FEEA592053,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157073Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:47.736{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C5AF5C7D6831DE58ECC1F63FD322843,SHA256=4F1D7D23A7CC9213FA39CE4B1766A7548686BBF0A8E7698BDC9809B451471F61,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098814Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC0B-60B9-8B01-00000000C601}4004C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098813Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098812Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098811Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098810Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098809Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098808Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098807Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098806Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098805Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098804Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DC0B-60B9-8B01-00000000C601}4004C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098803Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC0B-60B9-8B01-00000000C601}4004C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098802Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.464{38D812B3-DC0B-60B9-8B01-00000000C601}4004C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098801Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:47.401{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=59EFFD468A879DAEDF92BAB5157F5F29,SHA256=26EDBA584DF57FEFA0D9001D665BE87F4641EC9ABE07E02962F2981FE91C0410,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157075Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.767{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7EAAA8EE6352976FCBCEB5F2A886D1B3,SHA256=908FFCF368B6F5B864DBE70A82E3FA95949FAE349B82693D372499B7860446A9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098855Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC0C-60B9-8D01-00000000C601}2484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098854Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098853Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098852Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098851Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098850Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098849Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098848Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098847Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098846Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098845Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DC0C-60B9-8D01-00000000C601}2484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098844Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC0C-60B9-8D01-00000000C601}2484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098843Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.670{38D812B3-DC0C-60B9-8D01-00000000C601}2484C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098842Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.666{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4778820187D949ED8896F3380765F5D,SHA256=EB8B9557027B090827A5DAE2F412864749D808B9C0324D6C5EAA307CD88CB13C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098841Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.525{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4AF4E3A32B55FBBCF45CCBDC8D92048D,SHA256=4A77B7D3F21F0CC4048D265810563E371DF716CDEE80112B1E6559A23C31D8E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098840Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.525{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D0646334C2477C76FA0E55C80414F64C,SHA256=8BF3D6C4C5DD046C5CA52B0DB2EEBA086F46D76A7F45CAC1BF0DF9E3AE211C38,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157074Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:46.523{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58011-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000098839Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:46.485{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50186-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000098838Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.307{38D812B3-DC0C-60B9-8C01-00000000C601}2816696C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098837Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC0C-60B9-8C01-00000000C601}2816C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098836Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098835Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098834Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098833Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098832Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098831Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098830Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098829Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098828Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098827Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DC0C-60B9-8C01-00000000C601}2816C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098826Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC0C-60B9-8C01-00000000C601}2816C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098825Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:48.151{38D812B3-DC0C-60B9-8C01-00000000C601}2816C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 13241300x800000000000000098824Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000098823Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0020dab4) 13241300x800000000000000098822Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7590e-0x5e3e623a) 13241300x800000000000000098821Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d75916-0xc002ca3a) 13241300x800000000000000098820Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7591f-0x21c7323a) 13241300x800000000000000098819Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x800000000000000098818Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0020dab4) 13241300x800000000000000098817Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7590e-0x5e3e623a) 13241300x800000000000000098816Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d75916-0xc002ca3a) 13241300x800000000000000098815Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:53:48.135{38D812B3-D3C9-60B9-0B00-00000000C601}624C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7591f-0x21c7323a) 354300x8000000000000000157117Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.127{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local54177- 354300x8000000000000000157116Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.126{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local60812- 354300x8000000000000000157115Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.125{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local56588- 354300x8000000000000000157114Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.123{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local50839- 354300x8000000000000000157113Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.121{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local61721- 354300x8000000000000000157112Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.121{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53168- 354300x8000000000000000157111Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.118{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local60487- 354300x8000000000000000157110Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.118{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local51437- 354300x8000000000000000157109Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.113{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local51518- 354300x8000000000000000157108Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.112{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local51716- 354300x8000000000000000157107Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.111{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local55669- 354300x8000000000000000157106Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.108{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local60277- 354300x8000000000000000157105Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.108{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local61523- 354300x8000000000000000157104Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.107{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local59914- 354300x8000000000000000157103Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.106{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local56791- 354300x8000000000000000157102Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.105{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local54877- 354300x8000000000000000157101Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.104{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local61643- 354300x8000000000000000157100Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.103{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local55815- 354300x8000000000000000157099Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.103{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local50581- 354300x8000000000000000157098Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.102{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local51585- 354300x8000000000000000157097Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.102{27B03E6B-D3AA-60B9-1400-00000000C501}1056C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local51585-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domain 354300x8000000000000000157096Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.102{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local57655- 354300x8000000000000000157095Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.101{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local60774- 354300x8000000000000000157094Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.100{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local65535- 354300x8000000000000000157093Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.099{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local61733- 354300x8000000000000000157092Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.098{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local65535- 354300x8000000000000000157091Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.098{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58590- 354300x8000000000000000157090Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.097{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local56796- 354300x8000000000000000157089Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.096{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58405- 354300x8000000000000000157088Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.095{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local56027- 354300x8000000000000000157087Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.094{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local56591- 354300x8000000000000000157086Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.093{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local56659- 354300x8000000000000000157085Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.093{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-819.attackrange.local56659-false10.0.1.14win-dc-819.attackrange.local53domain 354300x8000000000000000157084Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.093{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local56578- 354300x8000000000000000157083Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.093{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMudptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local56578-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domain 354300x8000000000000000157082Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.087{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58013-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local49666- 354300x8000000000000000157081Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.087{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58013-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local49666- 354300x8000000000000000157080Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.086{27B03E6B-D3A9-60B9-0D00-00000000C501}896C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEtcpfalsetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58012-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local135epmap 354300x8000000000000000157079Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.086{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58012-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local135epmap 23542300x8000000000000000157078Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:49.782{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC56DB04908808566B577739B6FD34EC,SHA256=A6AD9442CDBAFC118E02B6D6F859E1B55241302BF78B386CE88581BC4846A467,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098857Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:49.665{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2818B39278831CC404106695D18FD17,SHA256=FE9F4E51955DD2649A1D03836FCCE3D5DEC2393ADBCD12CDBE6D451FE13CFC68,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098856Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:49.665{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=4AF4E3A32B55FBBCF45CCBDC8D92048D,SHA256=4A77B7D3F21F0CC4048D265810563E371DF716CDEE80112B1E6559A23C31D8E0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157077Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:49.689{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7F44D572A45A5117215EB02FFBBFAFBC,SHA256=E1BAABA1FE189822F6A7B4A77BC40891DA9BA92E3A66839447B86151840693FE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157076Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:49.689{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=313BDCB8CC27265721D9C2084886581D,SHA256=66081C372EC2E46DD3D12C62C08125563513A61AF7A97A77A6F1E29C489C0FDB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098871Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC0E-60B9-8E01-00000000C601}3152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098870Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098869Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098868Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098867Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098866Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098865Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098864Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098863Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098862Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098861Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DC0E-60B9-8E01-00000000C601}3152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098860Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.945{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC0E-60B9-8E01-00000000C601}3152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098859Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.946{38D812B3-DC0E-60B9-8E01-00000000C601}3152C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098858Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:50.758{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5CC8AA9AF937A8B70F5C1FF303AC82DC,SHA256=B2D9D71B372A0D351412454D8E6BCD42503591CCFB703E0906C0ECE84907E965,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157129Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.139{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local58565- 354300x8000000000000000157128Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.138{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local52444- 354300x8000000000000000157127Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.137{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local60673- 354300x8000000000000000157126Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.135{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58560- 354300x8000000000000000157125Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.134{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local59106- 354300x8000000000000000157124Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.133{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local60510- 354300x8000000000000000157123Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.132{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local59759- 354300x8000000000000000157122Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.131{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local54468- 354300x8000000000000000157121Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.131{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local61776- 354300x8000000000000000157120Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.129{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local54127- 354300x8000000000000000157119Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.128{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse10.0.1.14win-dc-819.attackrange.local53domainfalse10.0.1.14win-dc-819.attackrange.local62196- 354300x8000000000000000157118Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:48.128{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local54487- 10341000x800000000000000098886Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.773{38D812B3-DC0F-60B9-8F01-00000000C601}26043776C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157131Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:51.423{27B03E6B-D3A7-60B9-0B00-00000000C501}640680C:\Windows\system32\lsass.exe{27B03E6B-D3A5-60B9-0100-00000000C501}4System0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\system32\kerberos.DLL+96fe2|C:\Windows\system32\kerberos.DLL+794d4|C:\Windows\system32\kerberos.DLL+144c9|C:\Windows\system32\lsasrv.dll+2d231|C:\Windows\system32\lsasrv.dll+2b3f4|C:\Windows\system32\lsasrv.dll+30949|C:\Windows\system32\lsasrv.dll+2e2a7|C:\Windows\system32\lsasrv.dll+2d231|C:\Windows\system32\lsasrv.dll+15e0d|C:\Windows\SYSTEM32\SspiSrv.dll+1a96|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e 23542300x8000000000000000157130Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:51.157{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7593E2F237C76AC81E5AE409342AA398,SHA256=BDE9595F2304C63A75124EE11E0255A77957135F0069D93B583496938654A2FF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098885Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC0F-60B9-8F01-00000000C601}2604C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098884Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098883Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098882Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098881Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098880Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098879Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098878Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098877Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098876Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098875Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DC0F-60B9-8F01-00000000C601}2604C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098874Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.617{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC0F-60B9-8F01-00000000C601}2604C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098873Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.618{38D812B3-DC0F-60B9-8F01-00000000C601}2604C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000098872Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:51.070{38D812B3-DC0E-60B9-8E01-00000000C601}31521684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098903Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.772{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB8CED806DDDD7FE1B6C8F0335443C57,SHA256=61601E85C464A68486418AC53D4270B72E240FB3D7DC6357BC63DDAFD7791B0E,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157139Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:50.823{27B03E6B-D3A5-60B9-0100-00000000C501}4SystemNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58016-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local445microsoft-ds 354300x8000000000000000157138Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:50.823{27B03E6B-D3A5-60B9-0100-00000000C501}4SystemNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58016-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local445microsoft-ds 354300x8000000000000000157137Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:50.727{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsefalse10.0.1.14win-dc-819.attackrange.local58015-false10.0.1.14win-dc-819.attackrange.local389ldap 354300x8000000000000000157136Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:50.727{27B03E6B-D3AA-60B9-1600-00000000C501}1212C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58015-false10.0.1.14win-dc-819.attackrange.local389ldap 354300x8000000000000000157135Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:50.715{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58014-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 354300x8000000000000000157134Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:50.715{27B03E6B-D3AA-60B9-1600-00000000C501}1212C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58014-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 23542300x8000000000000000157133Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:52.392{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7F44D572A45A5117215EB02FFBBFAFBC,SHA256=E1BAABA1FE189822F6A7B4A77BC40891DA9BA92E3A66839447B86151840693FE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157132Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:52.173{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B2884F8C907AEB6A497AF7ACF80007FE,SHA256=40C872888A7BCF0282CD3714F04685B25A04E0869EEC057F3E11F6972875E399,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098902Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.413{38D812B3-DC10-60B9-9001-00000000C601}37723512C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098901Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC10-60B9-9001-00000000C601}3772C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098900Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098899Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098898Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098897Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098896Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098895Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098894Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098893Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098892Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098891Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DC10-60B9-9001-00000000C601}3772C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098890Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.288{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC10-60B9-9001-00000000C601}3772C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098889Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.289{38D812B3-DC10-60B9-9001-00000000C601}3772C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098888Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.085{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AF5324A1DA74C81725DAF0F29853CDEA,SHA256=3795D522CDA97FDB0A8FE2111D0311A6534AAAA3715ABE49B8CB8255D9110E6D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098887Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.085{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=72E4CD987A37DA146F608CD139A9C51D,SHA256=1DF5F185E9470406B5EB1FE01D45560795106794FCC1F173523113ABC3E6FF86,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098905Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:53.781{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9653450B5DBEFB2E020FDFFA2D11EFE8,SHA256=FB8539A06374C5A7DE868689AF51624EE4A44F8077B7A0BFD4A80F62FBD8A8B1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157140Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:53.173{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2EE03596F7FE2051D697D7A85A1D9B99,SHA256=CE80A7E83298B8A8F8437C209C12193D9437EB3ADB8290D7A570FC4B2204FDFD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098904Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:53.381{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=198F81626B80419D46665F91C3B179B0,SHA256=07BE7D92AD1F9C07A16C01EAF3CB23DC9BEA9A0C006980A2A56116AB14F9104F,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098920Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:52.438{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50187-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098919Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.780{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A1C5B5F557E9A1D07BC2484840126ED0,SHA256=B7596500D8B87708F8E0F6095BA29ADF20B924C3E9C4E44A4A0D7AD60A372923,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157142Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:52.491{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58017-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157141Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:54.173{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E311E4CA4008757ADE5293C43380CD28,SHA256=6FB97E5E5381052D628F481B1FE7F96DDF198B6A54723A5831EFC8E688F3A4F6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098918Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC12-60B9-9101-00000000C601}840C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098917Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098916Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098915Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098914Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098913Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098912Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098911Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098910Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098909Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098908Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DC12-60B9-9101-00000000C601}840C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098907Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC12-60B9-9101-00000000C601}840C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098906Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:54.047{38D812B3-DC12-60B9-9101-00000000C601}840C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098922Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:55.795{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9FDAC4B03CA9C6BADDA58AC920D578C6,SHA256=525DA9ADB7CF9470CD1C72F3A288EAEF9734D3FC84B6E769789909F23D721C47,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157143Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:55.173{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80F88EBD3570723FF080924ADF03D416,SHA256=C04907CA6C9D648E3E652D65C9701B79962810FC8C35E7C225F69A975D79AD7B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098921Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:55.155{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B375D7957E19F6B46E3D57B3656F5422,SHA256=44A43420CAC1F83820A59BA71AF44827B1C4817C860543CA9BC3F03C20E555CE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098923Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:56.794{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56C555D6577983ECEE56ABD752AC8F89,SHA256=B7AA0CB17B57312FBF0AD5E94E2F1A611169CFEE441B3B50DB33EA88D0CA9255,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157144Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:56.202{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CDF9F26BBE0B7981B97112458F391A4,SHA256=3A209FA5EFD5E532D56F8F2A029862DA8D0E2FEB27F465ED0437BF08447D97C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157145Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:57.237{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C670F3AE5B33030EAC5A9A1C69F0AD44,SHA256=24ACD1F504DCD2996F4CBCAF9110B01C4CA4F219D30FDF5AADAB088CB90210F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098924Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:57.809{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=49914DF276D1B1055986ECC63E83B8CE,SHA256=D67EB9EC8A7455CF0EA750BF10FA9D63DAA752051DAE744A72957D414D78DDE2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098925Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:58.809{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72F0A36C3DB40903D98324E71A496390,SHA256=7B07EF294EA0DEAA61BBEA937134D5FB190FD30E1C0DD5285D293BE4EB054CE8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157146Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:58.253{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CEB03C514DBF676E32AFB30E3A1CEF2,SHA256=B8574D71A1AE64EFA803069E91302EF9744616876F1870A9A688DB5AAF36EC2B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098927Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:57.557{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50188-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098926Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:53:59.808{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3759BC3A35878DC911F40A06B2A30D15,SHA256=908532D17FAAE8381EA5068CCF3D43CE8D6DEF5CB82798B5301CED8BCBEEE98E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157147Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:59.268{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=45A93A3202ADFBC048F2DF0516503824,SHA256=36760FA13E0732EA5801E95B23FCEA608297A0524E220F86156FCDF2CA4F3247,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098928Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:00.807{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65B770DC46DF69FE63CFEC8E9D52CBC4,SHA256=471195958F8DDA3F0EB709D22004916AB7F10FA130C8DB14B45ADD656BAED404,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157148Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:00.273{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A099A90EEC66BBAF1CB6BCBB3320BDFF,SHA256=24C82EFB3E6E8918D2D3421FD28934981A70FB7F8A74A4CB950FF7DA8BBC4C21,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157150Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:01.284{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3F4BA003B370D77085F45C997B7E3322,SHA256=8E649E3FA1C6FF4B45DA5250A8AA74CB88CFBC53A38F3267F42B25953F9D91EB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098929Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:01.806{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=008830AD35B6BCD5D13E85E0066DCE52,SHA256=DF889ABA6AAF218AF8FF604B26D2C2976FE14E7B3401E5D6A199DA1CE9A6CF69,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157149Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:53:58.462{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58018-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098930Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:02.806{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D35483BF897D5368433ABD947B9BFE8D,SHA256=E798A93967AD83A3F4AA4A9BA819D5749C3D3AD0FB219AAA61F1004FCF3CE570,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157151Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:02.300{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A458DB45D90FC9DA86B77CF22F0300C3,SHA256=A3F4A92555D6C529698BC068551B8534443FC5CA2BDFD4608B88319DAA117D00,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098931Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:03.805{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=84D0BD21F363EE9DE23274B1B0639F60,SHA256=1B387C86EEA037AD46D906D8301D16966054B701F25C3610352A78D03C363F70,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157155Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:03.472{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=41E7229D515E5C6B4817CBAA5F3E8ECA,SHA256=A62FB48667FEAAAD012B0D51AE62238A0BF915CB129F1559404C44B5B7550069,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157154Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:03.472{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=257FF89F213FB03B85F83E23BF679BEA,SHA256=836C18B46D3EB9D6B7738F997E1234EF742683F5B30923F25B2F4797D31496DE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157153Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:03.300{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D7E94569028470115E041EFE4765987,SHA256=BAE4ADD1F8BE92BD6143D91F442ED65869E73D0592228B592D15688F8E332D14,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157152Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:03.206{27B03E6B-D3AA-60B9-1100-00000000C501}380NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=2FD0EC63F48D9C3F719079AB9EE466ED,SHA256=EE6473B26B75C0ED871C701F39C17E83F9E2EF5B8E159A246278E32DCE0A326E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098932Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:04.820{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68204B2344C9643ECBDFCAD0F3729A86,SHA256=C3579EBA6ACBC4FF1DFB47AECD6F899308C1C309996A0E3045809C19F6C8CD2E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157157Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:04.987{27B03E6B-D3AA-60B9-1400-00000000C501}10564368C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x100000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\cryptsvc.dll+6124|c:\windows\system32\cryptsvc.dll+5e34|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157156Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:04.316{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2973156DB15DBBE032057A7AEE1D2F6E,SHA256=DA74E9042B830796B1FE87D8DD3DCF360402028799273F213FDF9D8DFC0C4785,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098933Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:05.835{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EA79939B726B51D9EF4295ED5CDFB022,SHA256=512C0F1CB79114F64CA011C4B9AB6114BD9DF76BE4F111EABAEFA905AA8172D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157162Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:05.316{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=642F8BDD0F0128F8F95FC86A40EE73F3,SHA256=F8BB07BDEA1CFF617D3074C4BA2E6F5FB010001BAC4F6C833B9185A20DFF2F84,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157161Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:05.003{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2900-00000000C501}2812C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157160Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:05.003{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2900-00000000C501}2812C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157159Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:04.987{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2900-00000000C501}2812C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157158Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:04.987{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2900-00000000C501}2812C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098935Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:06.834{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C7B2EA8618FFF15436739DB82497910D,SHA256=F6C16885CC8B41015E0800E4C1B0B7285FC0D4E1B1090DC78088AF3EA7359635,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157167Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:04.448{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58020-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x8000000000000000157166Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:04.378{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58019-false93.184.220.29-80http 354300x8000000000000000157165Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:04.376{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local57524- 23542300x8000000000000000157164Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:06.316{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=703966BFD967DA036304594D7F910952,SHA256=808A4C83569DE4B631BBDCAD54DC7F633896A2507AD2B7EBFC3F826978C87260,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098934Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:03.307{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50189-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157163Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:06.159{27B03E6B-D3BA-60B9-2A00-00000000C501}2856NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098936Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:07.833{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0660C25AED4C4B99790EAC2EB5CB1436,SHA256=CF4022C1925D2CD925394E13DC9E3665FF79B5D901AE4520B1884C4F0A23E000,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157192Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.550{27B03E6B-D624-60B9-EE00-00000000C501}45404648C:\Windows\system32\taskhostw.exe{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d832|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157191Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.503{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b3175|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157190Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.503{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b308e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157189Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.503{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b3057|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157188Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.503{27B03E6B-D625-60B9-F500-00000000C501}5024392C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b3175|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157187Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.503{27B03E6B-D625-60B9-F500-00000000C501}5024392C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b308e|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157186Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.503{27B03E6B-D625-60B9-F500-00000000C501}5024392C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b3057|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157185Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.503{27B03E6B-D625-60B9-F500-00000000C501}5024392C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157184Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.503{27B03E6B-D624-60B9-EE00-00000000C501}45404648C:\Windows\system32\taskhostw.exe{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d832|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157183Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.456{27B03E6B-D624-60B9-EE00-00000000C501}45404648C:\Windows\system32\taskhostw.exe{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d832|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157182Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.456{27B03E6B-D625-60B9-F500-00000000C501}50241564C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b2af0|C:\Windows\System32\TwinUI.dll+12d4e1|C:\Windows\System32\TwinUI.dll+12dfcf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157181Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.456{27B03E6B-D625-60B9-F500-00000000C501}50241564C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+981b0|C:\Windows\System32\SHELL32.dll+b2aac|C:\Windows\System32\TwinUI.dll+12d4e1|C:\Windows\System32\TwinUI.dll+12dfcf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157180Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.456{27B03E6B-D625-60B9-F500-00000000C501}50241564C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b2a80|C:\Windows\System32\TwinUI.dll+12d4e1|C:\Windows\System32\TwinUI.dll+12dfcf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157179Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.456{27B03E6B-D625-60B9-F500-00000000C501}50241564C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+12d319|C:\Windows\System32\TwinUI.dll+12dfcf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 11241100x8000000000000000157178Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.localEXE2021-06-04 07:54:07.409{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exeC:\Temp\59a9f0de96eff57768e995b296ae75778a232f30d95a7b7ab5048c621b50c66d.exe2021-06-04 07:54:07.409 10341000x8000000000000000157177Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.316{27B03E6B-D3AA-60B9-1600-00000000C501}12124224C:\Windows\system32\svchost.exe{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157176Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.316{27B03E6B-D3AA-60B9-1600-00000000C501}12121256C:\Windows\system32\svchost.exe{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157175Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.316{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7956BDB5032FE3FAA6511AAE23C6238E,SHA256=BEAC58EF2B56ECF38BF71042146FF1F1EABD192F2C5051D745AFC7F9678C75A5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157174Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.300{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157173Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.300{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157172Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.300{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157171Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.300{27B03E6B-D622-60B9-E100-00000000C501}11484684C:\Windows\system32\csrss.exe{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157170Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.300{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157169Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.300{27B03E6B-D625-60B9-F500-00000000C501}50244952C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\7-Zip\7-zip.dll+4f38|C:\Program Files\7-Zip\7-zip.dll+61c5|C:\Program Files\7-Zip\7-zip.dll+698e|C:\Program Files\7-Zip\7-zip.dll+6aa9|C:\Program Files\7-Zip\7-zip.dll+8771|C:\Windows\System32\SHELL32.dll+d0c97|C:\Windows\System32\SHELL32.dll+b6e2e|C:\Windows\System32\SHELL32.dll+16ec6c|C:\Windows\System32\SHELL32.dll+19e878|C:\Windows\System32\SHELL32.dll+284653|C:\Windows\system32\explorerframe.dll+13cf7b|C:\Windows\system32\explorerframe.dll+139d07|C:\Windows\System32\SHELL32.dll+16efb0|C:\Windows\System32\SHELL32.dll+16c38e|C:\Windows\System32\SHELL32.dll+c40f1|C:\Windows\System32\SHELL32.dll+c6fd6|C:\Windows\System32\USER32.dll+121e4|C:\Windows\System32\USER32.dll+11d7b|C:\Windows\System32\DUser.dll+17b15|C:\Windows\SYSTEM32\atlthunk.dll+1026 154100x8000000000000000157168Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:07.297{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe19.007-Zip GUI7-ZipIgor Pavlov7zg.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Temp\" -an -ai#7zMap12996:166:7zEvent14632C:\Windows\system32\ATTACKRANGE\Administrator{27B03E6B-D623-60B9-31C4-0B0000000000}0xbc4312HighMD5=04FB3AE7F05C8BC333125972BA907398,SHA256=2FB898BACB587F2484C9C4AA6DA2729079D93D1F923A017BB84BEEF87BF74FEF,IMPHASH=9CF6F80DD6DFE9900700C1E11C318B2A{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 23542300x800000000000000098937Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:08.833{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=32F474EE85F30EB2FB220E6E28C4C5A5,SHA256=8038986602BDC7720FF22CD18192C98CCBCEF7AAEB10097FFCDD01F7DE984B28,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157195Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:08.316{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=04884CDCA084535C3EBA33ECAF62DEAE,SHA256=62B61691831E31E4534CACF004E9F93E82484C30217C4834B606235930722438,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157194Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:08.316{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=41E7229D515E5C6B4817CBAA5F3E8ECA,SHA256=A62FB48667FEAAAD012B0D51AE62238A0BF915CB129F1559404C44B5B7550069,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157193Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:05.540{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58021-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000098938Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:09.832{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=70FABCBB4A53E73EC710536835637BC9,SHA256=B7B367E1CEB2E41A54B91B6D13CA2063760F1FEA844C11FF2B5955F1EE13ADED,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157201Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:09.331{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E1718037DA4BAC8B2A6CA85B10EDD05E,SHA256=4D7CEC29A0E6BAB37DA1B96C79753FAE988488F893B4ACD6199DEEA678132665,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157200Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:06.569{27B03E6B-D3AA-60B9-1400-00000000C501}1056C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudpfalsefalse127.0.0.1-57892-false127.0.0.1-53domain 354300x8000000000000000157199Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:06.399{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsefalse127.0.0.1-53domainfalse127.0.0.1-57892- 354300x8000000000000000157198Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:06.399{27B03E6B-D3AA-60B9-1400-00000000C501}1056C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICEudptruetrue7f00:1:0:0:9840:e693:be7:ffff-57892-true7f00:1:0:0:0:0:0:0-53domain 354300x8000000000000000157197Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:06.368{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudptruefalse10.0.1.14win-dc-819.attackrange.local64314-false10.0.0.2ip-10-0-0-2.eu-central-1.compute.internal53domain 354300x8000000000000000157196Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:06.368{27B03E6B-D3BA-60B9-2800-00000000C501}2804C:\Windows\System32\dns.exeNT AUTHORITY\SYSTEMudpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local53domaintrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local57892- 23542300x800000000000000098939Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:10.831{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E93C490788B58C125A1D6312631B9EE1,SHA256=78F2F5E5839749F70D4ECC6EC49E704ABEA6FC2EA014D4AC4DB53C0696B1C854,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157202Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:10.331{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F129627115535F14749B8CB5F178B1E9,SHA256=1CAA0F8181C5C9C09344C099A1F4AB28763C179BEA2FCA83F080127CC7238872,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098941Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:11.846{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=71DE703122449DA4A07C38A806E400E3,SHA256=4CD1F7FC0BDC8E4C3437B5C30F84070C17FE19C87BA7074F3A6343B87DF60695,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157206Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:11.675{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b3175|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157205Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:11.675{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b308e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157204Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:11.675{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC1F-60B9-B501-00000000C501}5632C:\Program Files\7-Zip\7zG.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b3057|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157203Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:11.347{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FDA47704F0ACA2F938BAC1133E624DE9,SHA256=7E41B9BA180A289272A8CB0FAB8CA1B9844BC11A45AD03AEDAFCC7F993B190FC,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098940Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:08.479{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50190-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098942Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:12.859{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C392028293DB980272B8E42042080DB4,SHA256=B6C53A5A8837A670CAFF50A58A7A6FEDE810F15C19CE1DA5FB5769B3565DFF50,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157208Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:12.394{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88ED24B934E721889C98B1B1281CDF17,SHA256=FFBB448C9CABEA574177477646D521B2BFE5A0FF321A0748DD9D7833D2EE75A9,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157207Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:09.446{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58022-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098943Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:13.867{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F70C4BD1E16E3478230D48B99234CB16,SHA256=682F03CECE2382BECE3BC0F7E0C8DAEAE1B15F115784362D5364CAE39034471B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157209Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:13.425{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9104D225D33A462AC6115011DD6C2F3,SHA256=94E84A6BB77AB2B4ABD210CAE84180DA9B4380C36D383B548E23ADD700EABA02,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098944Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:14.866{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88FD1681B044BA9718C9D4E04D1DF2D1,SHA256=81B8B12754D187C848D0C2EE2EB994111821E4A8DB6F2B7755320C1AE9BD9F3A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157210Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:14.457{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F09DF57DE12736D13B4BA8EE36E289A6,SHA256=2FC2FD12351E2A6EB096D0A075863D4A45955FEA5C5F17EC8805D89B455B8B2E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098945Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:15.865{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=087BE7BFD0530C14DCA49BE2A7D8F50B,SHA256=F969B2155D3EC91F6698A0ED70BCAB678847CA50CACCD885986DFAB1AA2379E2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157211Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:15.457{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5E978695F167FA2A87A577363FC11C4E,SHA256=D10F1F71133B0CCE78FC40B4DF960B7D8D98D74938771979FA38C39661E2BD25,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098946Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:16.865{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67106EA4BCEC57A0C1AE310C178A5ABC,SHA256=9174F7A58E5D045B6887B20DB690B6F28F0DBB0CE9BBAA36616B646233BA3B0A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157212Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:16.644{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=47A10330B864AFA046D59477105633F6,SHA256=C9A9847AA7C27551FD1716D535E07408467496321BA3DB67315226D931F68368,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157213Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:17.660{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5F42B575D1491C7563430A7599576B33,SHA256=8CE443D1D013FB0E661B7A527CC26B2F1DBBC5BA47FA2E33AD870FC559D3C528,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098948Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:17.864{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D5290CE11D4F100D1EEF2AD8950D0FC,SHA256=CB9AE4E67BCB1251CFE7B71112E6879E344FB24CE0F87FE59A113F834699F7E6,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098947Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:14.391{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50191-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157215Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:18.676{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3666970A6C83E169EF38F7C528492F45,SHA256=27444846A3E194E83B89CB68A046F77BDE3ADFDD01BA88604B4A1934C594FB3B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098949Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:18.879{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FC30EE3AC075DB9A5C35963C4A725745,SHA256=94CA9C7F47EF18F8546E11124A68501F1EE32BC487F2A0ECEAD7DFB4C7B4DBAD,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157214Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:15.462{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58023-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098950Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:19.879{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A37153EA594FA5D33091D015A6A3C9D9,SHA256=5CABC33E3A0BEFFB43DFF1458B618EAD1CED5DBC6EE30E580569FD7F0FBC1CCC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157216Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:19.723{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CA575B4D678123B0A9C217F4D3736AD9,SHA256=B28A319A7C94AC3BBCE81F5864D9A40920794114C2B12DFAA263D008ACD5430E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098951Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:20.894{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=970413568FBB5ECD17F4DDBDDBBAB514,SHA256=4FFB8A58AAC25C1C86C3C4DADABABD4831BD242F3DE1CC184E62FB4979E5AF77,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157217Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:20.723{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A12683E2092CA86977C34FD202F61BD,SHA256=93DB1747EC6C47C2211B377A51D334B0632130630C1AA4AE3D5CAA5797C76F45,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157218Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:21.723{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5DE27A2600CFC5BF9D1751A1CD790EB5,SHA256=3FACDF9A2CC2B0169F96E0692C5F323FE107690B6A66D9A85F4A12E528C68530,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098952Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:21.893{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C465F4A2D0DBDF64453A80D592C02D0,SHA256=4DA6903F1A6D55FB631DCDB8BD41964F875F85A25F9825DD2C2213EFFFCB009E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157219Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:22.738{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC5403F159FB44917500476C52859822,SHA256=FCC09FEFB7BC068D214C2A447A4474A8EC6BB7B39A2EB89E41967153A5B5DFB2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098954Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:22.908{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=307393BA6658255D1CCF7AAD9F44226C,SHA256=1ADABA00A7A025AD6490BF5A58E52FEBA80B8DCE571D08604FB734564353C5DE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098953Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:22.143{38D812B3-D3CB-60B9-1C00-00000000C601}1936NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098957Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:23.907{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9463606F2791D94B197C4BAD11EC877B,SHA256=48FF47941C31821E590C9BDA6D58B22C643A20F11C5F19B473970EA5FB47D7CA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157220Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:23.738{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D3D8F2971C08C5EA1B75A336A8509C66,SHA256=94F460BC6F98FAB20DF385FDFC9AE6016560A6C8F15D24904454DAA070A2324D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098956Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:21.439{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50193-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 354300x800000000000000098955Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:19.547{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50192-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157222Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:24.738{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=00F6CC7105B1F1FD366DED69B3902776,SHA256=43FA62600666C90BAE39DF4BC2940A1BFF10DFFAE464655BBBD6227C865EA4F1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098958Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:24.907{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BC6FE4722F17F2FDC904FDEC938797C,SHA256=89FFB77D8FF735DB6D1BD45AE2E2918FFB54F68321DA77B7471C3A9A7AAB369E,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157221Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:21.399{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58024-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157223Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:25.770{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6BC092B4D00CCF6825F131C1F9E0027D,SHA256=2D9C7CF6C11C7974CA50D8CDFE966D3CC40281849661CC1E07FFA594C1EBF798,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098959Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:25.906{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AEEB2541292847BED5F950D73B839D08,SHA256=47B9F2D650657BC8A410F6588F70BD06EF4E7421B42F50E77C343C26C5A65D98,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157224Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:26.801{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D5762C065DD2F871F8CA77869E360BCE,SHA256=051BA62B36FB0D3BE392AF566B0755A6FD8A5B743BDBCD3B9CF86468195BAD89,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098960Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:26.906{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=31114298ECF6B2C7E6B0D03558382735,SHA256=0A0A7B96117268A4BD506B699843407A4A8E5BCA108560A2F0370A3CA9F8C795,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098961Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:27.921{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=341B2686C69B4591C147E7E845A921B8,SHA256=2D76EBE02AC3C8D44DFEFD97D85F5106D078790D62D7C4BE985B1DD322E11069,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157225Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:27.817{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8BED0B6445373B03A4C51D0973EC9732,SHA256=DAE73932DC0561EE907DB9F11299CA3CFC3DC90242C7D125ABC45831308E411B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157227Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:28.848{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8B6FB93F5478DD7177B8DF2E5943E02B,SHA256=C1A78727493CB836B72C1B30A2AF7335555FEF6321A9EFE5E3B76492EAD7EDB3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098963Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:28.920{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=60E4D3822158E178058FABC70D657127,SHA256=D82599C076FDA0D2B3B605EE5E14647159650CFB983AD2E32521E84F2D32BCE8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098962Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:25.485{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50194-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x8000000000000000157226Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:26.462{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58025-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157228Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:29.973{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E9C3C9010EF1F8F04DFF039AB68AE690,SHA256=16E7B6C772682F25F822A300CCD49A0200547D8324A4F3E1BA0FFAE28E35944F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098964Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:29.920{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D4B9C7F7AC8A5D1BAD81D7CACFDF1B83,SHA256=27E73ECA4F1F8752906A555D63B40957D75A137A99636798A791564B2071B80C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157229Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:30.973{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1D00A1E06E5934AEE41C85493266916F,SHA256=5D4D6FDAE83641AB9C727B2FE5A092E1677CC84FD73AA32A35864EF5B38CD21B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098965Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:30.919{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C17FBBF15C9C4EFF189DF689BC4D1DE0,SHA256=002A25CF54663C9FA2861C2896AE25DAC648DC7589F5C7CFA2FF19CA588D205C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098966Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:31.919{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2BCCE2FD908D3D2B718A5216232CE913,SHA256=F771F7B3A04D1D8F22568BC627FBE78BDB2F41FBC41E7CC07C88566A922A73BF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157238Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.973{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=618296D87BACD4E91D6EB702599C1CBD,SHA256=913BC965CCF769134017737A2826E2DD70B8A37FF046F30860F33AE3EC837B46,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157237Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.723{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC37-60B9-B601-00000000C501}972C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157236Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.723{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157235Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.723{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157234Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.723{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157233Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.723{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157232Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.723{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DC37-60B9-B601-00000000C501}972C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157231Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.723{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC37-60B9-B601-00000000C501}972C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157230Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.724{27B03E6B-DC37-60B9-B601-00000000C501}972C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098967Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:32.918{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=69334B7F745337467B284DFD2FFBCB6B,SHA256=62D7CB034A17240B60C80ABCC4D79139DB820918570718CDAF9DC190BE1574B5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157249Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.958{27B03E6B-DC38-60B9-B701-00000000C501}24244636C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157248Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.786{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC38-60B9-B701-00000000C501}2424C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157247Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.786{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157246Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.786{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157245Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.786{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157244Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.786{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157243Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.786{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DC38-60B9-B701-00000000C501}2424C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157242Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.786{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC38-60B9-B701-00000000C501}2424C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157241Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.786{27B03E6B-DC38-60B9-B701-00000000C501}2424C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157240Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.754{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D2BE16B7821EEBB282280C8399C3D694,SHA256=04D4E50688CAE9DB6D3FD97A0CCE08167725FF55BE36EA2E0E5FA2C271739E32,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157239Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:32.754{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=91CB5F0EB421575064CB9A237B5513AF,SHA256=459A4FEA07CA3C3D6E38B208F2872CE46F211E8D79D6ECF79D0674E014E03B26,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098969Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:33.919{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1EE52A6C4389DC73A1F7CF5FEBDDCDA8,SHA256=416D86613E4A4CF440F6A2D034085822529FCA931E7A0D23B37ED052B9E0145D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157260Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.926{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D2BE16B7821EEBB282280C8399C3D694,SHA256=04D4E50688CAE9DB6D3FD97A0CCE08167725FF55BE36EA2E0E5FA2C271739E32,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157259Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.556{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58026-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000157258Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.457{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC39-60B9-B801-00000000C501}2056C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157257Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.457{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157256Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.457{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157255Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.457{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157254Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.457{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157253Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.457{27B03E6B-D3A7-60B9-0500-00000000C501}4202108C:\Windows\system32\csrss.exe{27B03E6B-DC39-60B9-B801-00000000C501}2056C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157252Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.457{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC39-60B9-B801-00000000C501}2056C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157251Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.458{27B03E6B-DC39-60B9-B801-00000000C501}2056C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157250Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:33.004{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8B5F0427F482695EE2DE647499B0E12,SHA256=4391CF7A954D8025D590BCED5ED9651247A659F2676AF17321682D464C2AF8E1,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098968Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:31.423{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50195-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098970Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:34.934{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07373C2914FCA89A07F97FCBD5447EA2,SHA256=62A13F22D22A8B5D3F75D5C8A3E98DB28327EABD08FE686E4A5219B173913483,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157303Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.853{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58027-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 354300x8000000000000000157302Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:31.853{27B03E6B-D3BA-60B9-2600-00000000C501}2784C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58027-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 10341000x8000000000000000157301Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157300Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157299Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157298Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157297Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157296Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157295Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157294Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157293Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157292Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157291Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157290Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157289Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157288Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157287Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157286Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157285Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157284Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157283Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157282Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157281Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157280Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157279Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157278Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157277Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157276Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157275Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157274Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157273Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157272Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157271Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157270Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157269Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157268Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157267Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157266Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157265Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157264Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157263Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+ca3e|c:\windows\system32\rpcss.dll+ba7a|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157262Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.379{27B03E6B-D3A9-60B9-0D00-00000000C501}896916C:\Windows\system32\svchost.exe{27B03E6B-D626-60B9-F600-00000000C501}4272C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+ed71|c:\windows\system32\rpcss.dll+b954|c:\windows\system32\rpcss.dll+ce2e|c:\windows\system32\rpcss.dll+a853|c:\windows\system32\rpcss.dll+42251|c:\windows\system32\rpcss.dll+42382|c:\windows\system32\rpcss.dll+426bf|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157261Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:34.239{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E74C83AC51B0D8C06A1EADD7B88E1E1A,SHA256=6D60AA79E98F2EB6AF91CE8EF06225C007420B937BBE55472C0090D69247CE69,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098972Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:35.934{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BA87BDAB7647DB7CB22E557BD32FE615,SHA256=FA7113B14F1F176088EB9A44E19DA3F6F6EB976CFBEF9BB063846800BD1302BB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157321Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.989{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC3B-60B9-BA01-00000000C501}5032C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157320Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.989{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157319Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.989{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157318Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.989{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157317Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.989{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157316Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.989{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DC3B-60B9-BA01-00000000C501}5032C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157315Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.989{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC3B-60B9-BA01-00000000C501}5032C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157314Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.990{27B03E6B-DC3B-60B9-BA01-00000000C501}5032C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000157313Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.489{27B03E6B-DC3B-60B9-B901-00000000C501}59765256C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157312Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.395{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2940BD119C2CDE2BE31335A63E630C62,SHA256=9E43BC4BD652186A7A9CD9FB6B658922339CABE57A968A5541F9B67219D884B3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157311Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.317{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC3B-60B9-B901-00000000C501}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157310Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.317{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157309Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.317{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157308Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.317{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157307Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.317{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DC3B-60B9-B901-00000000C501}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157306Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.317{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157305Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.317{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC3B-60B9-B901-00000000C501}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157304Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:35.318{27B03E6B-DC3B-60B9-B901-00000000C501}5976C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098971Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:35.606{38D812B3-D3CA-60B9-1300-00000000C601}96NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=8342034AFFF4E7106C01E10FEB9D2592,SHA256=BD8ED091AA614A4839474418523378DE4C91100D8557006FBF2BA625FDF9847B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098973Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:36.949{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6BEA009E59BE764851A304A3CC956C4,SHA256=0F5993D51A39432867D295ADB2DB7DA48031CB5E154D96075A078839013C7352,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157333Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.817{27B03E6B-DC3C-60B9-BB01-00000000C501}58845828C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157332Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.661{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC3C-60B9-BB01-00000000C501}5884C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157331Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.661{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157330Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.661{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157329Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.661{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157328Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.661{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157327Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.661{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DC3C-60B9-BB01-00000000C501}5884C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157326Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.661{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC3C-60B9-BB01-00000000C501}5884C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157325Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.662{27B03E6B-DC3C-60B9-BB01-00000000C501}5884C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157324Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.536{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB784FA83E6D16D1DF5BCC9B8705A9C9,SHA256=DC084B149490E95F6D878DEAA4F96C8F03488F9AC4463CAB3207CE6B13386859,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157323Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.536{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=116A3DFAF53FE9537CB66925F7538664,SHA256=50BAA6D2DFE1706687006C6AE0E61075691CF96646DFBAD41D40A1602D7A9644,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157322Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:36.161{27B03E6B-DC3B-60B9-BA01-00000000C501}50322980C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098974Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:37.964{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=98E131CFF6BBB65C71A0CE8027C04E8C,SHA256=B399F019DD90B9D63DE222134CFA160334F055E61EA2A74B2C4011387C8BB328,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157335Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:37.661{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=BBF0DDA7C50319038628ED8318CE25A1,SHA256=F3D0DC9D9B46258B2C0D2FDD238177ACB626AEE7FA1B7E4EBF91D51F4BBF9422,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157334Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:37.551{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AC9652EC85C4B8629AFE3E07ADB77F51,SHA256=17275F04604F95EA60BFFA72FECDD23302FCBFCC78A0DEF3090D46C937F23817,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098975Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:38.963{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=078AB304F66A4820F21FB32A69209510,SHA256=6C219E20E0FCD12A1E31BC5ABB18A457E0BBBDD1D5C0AB139D29250DCD496BE5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157344Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:38.598{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20BF7FCDAEB37001DC283FD797DFE862,SHA256=45D5D419514AAAE17B445EA689684C16DD496E0F89764B59F1B4A96D69FCFDD2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157343Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:38.489{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC3E-60B9-BC01-00000000C501}5528C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157342Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:38.489{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157341Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:38.489{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157340Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:38.489{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157339Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:38.489{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157338Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:38.489{27B03E6B-D3A7-60B9-0500-00000000C501}4202108C:\Windows\system32\csrss.exe{27B03E6B-DC3E-60B9-BC01-00000000C501}5528C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157337Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:38.489{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC3E-60B9-BC01-00000000C501}5528C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157336Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:38.490{27B03E6B-DC3E-60B9-BC01-00000000C501}5528C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000098976Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:39.963{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6DFB634CE2F9810329C69E5DE45143BB,SHA256=EECD76E4FF931D4486C6F8921C691FBC8AD04D208035FA4BCAD72F321C5D395D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157350Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:39.614{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C8A30C42495C0D1D356A1420BFBE88C4,SHA256=4DC8576FF7D8927C7CFCD925726C283F78FE9CE9D6B5D3854D68198A0E24790A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157349Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:39.505{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=8572E9C329204E6B888BFA5329086323,SHA256=51451AD04ABCD94B2D6E848D782658CEBD48C7F6B1297700AF805415019A76B9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157348Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:39.286{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2900-00000000C501}2812C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157347Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:39.286{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2900-00000000C501}2812C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157346Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:39.286{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2900-00000000C501}2812C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157345Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:39.286{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2900-00000000C501}2812C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000098978Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:40.962{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F0791FA718CA6F447F4BFD22AB42EBA1,SHA256=18CFCA6F05744F4300AAF131EF13D1AB7CD0DAF15F8C94A84CE912F0276DB344,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157352Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:37.524{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58028-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157351Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:40.645{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4671892A34CDACD639A6759BA8612109,SHA256=0972A181A0F49E15F65BCB56ADCB5D7EB0E35C6658ED3DE5A89BDEB6E3B8D9C8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098977Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:37.408{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50196-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000098979Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:41.962{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE36A70FA2FB76B03346146A735F2593,SHA256=C4468EBEF5E6CAF03E30090D0BD755B479707133A20B094DEBC594F6C1BB9787,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157353Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:41.645{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6C64B5FEEFC79C210425FB22D1274BD4,SHA256=7A3B16C87513A4AB7A6F2A280C9F6FE5128F3C8CE1DEF4F8FBC0F9774114FD37,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098980Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:42.962{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D55243504D0AD83498C2E6A73A64B0A6,SHA256=3CBE415DB7D5BE14B09E3034FEBEC28233554B4EB1D02FF9E09AF8AE048E0AB6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157354Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:42.645{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7FB6F9973CA02560725D1A5B937204C2,SHA256=BF07B437E2FC108EAA5212741ECB1BE28CB058B8B1E380AC7B53DC2A7A1DBA93,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157355Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:43.646{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0BA1BE330A67CAB7D7CF951FF3D6F963,SHA256=E2F7A7503AA3EB53D28F9B86FCD41472AFEBA08EBF17A7CDA7B6D0E352DD53EA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157356Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:44.677{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=43683558235DE50326EA6A2364092D35,SHA256=785A62087DD42995622FD605E78B5E80C497BEBD744A39D208ADEC528B5969C4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098981Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:44.180{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EE2F2287FC7980A39177EB65C1C5C206,SHA256=5526688C344DF7A2711BB51259C6A30D27D60951CE9559B6CEABF25060DA8FAC,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157358Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:43.509{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58029-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157357Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:45.708{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=146792FE55A0102994B210FC890E3E1C,SHA256=C25E8D6003EB37AE282E7354EE9A8CE1AF595350CE56BA6EA4C787E691E91E2F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098983Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:45.382{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=67C83F076868E695AD12C45F5798DF2D,SHA256=4758F00C1072C118C4CC07AEDA2B7B60930CD4F6E7FBC603B9FF1E61A13472C2,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000098982Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:42.549{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50197-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157359Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:46.724{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=06CE4BCEC3C83B7ECBE3CEDA66D93C09,SHA256=23B5C54B82E7D443200B9BE1E64DC2618979400B1D1C40D58E7734EBCC45800E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098984Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:46.538{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F2228114425B7135E4384F57E94E23E2,SHA256=FE8CCFC858FB5663898F21DEC2FC10D62EDB11206C31B982F75592E6D2C7FD7B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157360Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:47.724{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=600774124EF8EF96D90A6E484588B18F,SHA256=4BD7B9F0C8F78D1E2A0EA891D4437BDD3E55D44C40EA2A7964B2DE1973EDEB56,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000098998Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.662{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=05228437258D608E2C9A5DEAA45F2C2B,SHA256=E24AAF5DA5A7D1E490AC44175AC704A6A35B4C8FC7DF6FCB816B8437A6FCC343,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000098997Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC47-60B9-9201-00000000C601}3012C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098996Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098995Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098994Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098993Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098992Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098991Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098990Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098989Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098988Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000098987Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DC47-60B9-9201-00000000C601}3012C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000098986Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.428{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC47-60B9-9201-00000000C601}3012C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098985Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:47.429{38D812B3-DC47-60B9-9201-00000000C601}3012C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157361Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:48.958{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D64C442ACCE035D289AD513AB648CCC9,SHA256=78123D85E11036C56A9308A0ED1C59CCEFFBBE7A8AD04071CAF848E019E31152,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099028Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8F4C793A11461B8A54E49F4C039EE5AD,SHA256=5D7D8074A04D240AC83C8246171A895AABE09F4CC86D452C4FB2C10A5DF9DF62,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099027Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC48-60B9-9401-00000000C601}1824C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099026Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099025Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099024Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099023Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099022Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099021Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099020Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099019Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099018Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099017Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DC48-60B9-9401-00000000C601}1824C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099016Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC48-60B9-9401-00000000C601}1824C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099015Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.803{38D812B3-DC48-60B9-9401-00000000C601}1824C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099014Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.584{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A6EB7F725C143463ACF21F343FEF2B5D,SHA256=307A073E221FBFC638051E70F29B4F9B8684631472C68C382A9978412E010326,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099013Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.584{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=74CF2C271E903B8B951FDD25CCC216D0,SHA256=F3F028BD0E225BB1DF811689AD148992163F731C6D533C8839400C6D5DBEE865,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099012Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.256{38D812B3-DC48-60B9-9301-00000000C601}83664C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099011Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC48-60B9-9301-00000000C601}8C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099010Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099009Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099008Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099007Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099006Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099005Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099004Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099003Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099002Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099001Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DC48-60B9-9301-00000000C601}8C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099000Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.131{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC48-60B9-9301-00000000C601}8C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000098999Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.132{38D812B3-DC48-60B9-9301-00000000C601}8C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157362Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:49.958{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7171697EA6A746458969ED923A925667,SHA256=1893A05D5D10B17A3136FD5952D598AA7261FBA07FC0BE37C8DC8FAFC3A7209C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099030Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:49.990{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A6EB7F725C143463ACF21F343FEF2B5D,SHA256=307A073E221FBFC638051E70F29B4F9B8684631472C68C382A9978412E010326,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099029Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:49.865{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E8E58925BBAA647F512E3A89327C442F,SHA256=8A3BBA4A4A58896102CBE9ED2A821A11CD6CE7A976A4DCF6B3C601EE5B6522E1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157373Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.990{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A511EC3633407C8B2A61808D6BF2D46,SHA256=78A5C5079E0FE5B36541F9FFC0F7C9F6E0FC35DED1C85CAF2199620333E02F57,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157372Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.646{27B03E6B-D3AA-60B9-1200-00000000C501}5085492C:\Windows\System32\svchost.exe{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157371Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.646{27B03E6B-D3AA-60B9-1200-00000000C501}508412C:\Windows\System32\svchost.exe{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\pcasvc.dll+52e4|c:\windows\system32\pcasvc.dll+58a9|c:\windows\system32\pcasvc.dll+5b49|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157370Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.646{27B03E6B-D3AA-60B9-1200-00000000C501}508412C:\Windows\System32\svchost.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x1440C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+5bab|c:\windows\system32\pcasvc.dll+5b07|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49cde|C:\Windows\System32\RPCRT4.dll+30ed7|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157369Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.630{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157368Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.630{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157367Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.630{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157366Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.630{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157365Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.630{27B03E6B-D622-60B9-E100-00000000C501}11482272C:\Windows\system32\csrss.exe{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157364Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.630{27B03E6B-D625-60B9-F500-00000000C501}50246092C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Windows\System32\windows.storage.dll+16e61f|C:\Windows\System32\windows.storage.dll+16e295|C:\Windows\System32\windows.storage.dll+16dd86|C:\Windows\System32\windows.storage.dll+16f1f8|C:\Windows\System32\windows.storage.dll+16dbae|C:\Windows\System32\windows.storage.dll+fd025|C:\Windows\System32\windows.storage.dll+fd3a4|C:\Windows\System32\windows.storage.dll+fc9e0|C:\Windows\System32\windows.storage.dll+1664ae|C:\Windows\System32\windows.storage.dll+1661a2|C:\Windows\System32\SHELL32.dll+90ee1|C:\Windows\System32\SHELL32.dll+8fd46|C:\Windows\System32\SHELL32.dll+d0c11|C:\Windows\System32\SHELL32.dll+b6e2e|C:\Windows\System32\SHELL32.dll+18d33c|C:\Windows\System32\SHELL32.dll+18d093|C:\Windows\System32\SHCORE.dll+33fad|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157363Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:50.639{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0.0.2.5x64dbgx64dbg--"C:\Temp\release\x32\x32dbg.exe" C:\Temp\release\x32\ATTACKRANGE\Administrator{27B03E6B-D623-60B9-31C4-0B0000000000}0xbc4312HighMD5=5D5D5DA0946B7AB9F265781747ED9B41,SHA256=3FDFCE3C4E3B01855AB5D783FD7823D6FC0978B3F4B455E6AD9C5FA45FE67D46,IMPHASH=1998FE4CAB45B8BE9829BC474A106219{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\explorer.exeC:\Windows\Explorer.EXE /NOUACCHECK 10341000x800000000000000099043Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC4A-60B9-9501-00000000C601}3756C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099042Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099041Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099040Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099039Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099038Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099037Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099036Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099035Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099034Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099033Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DC4A-60B9-9501-00000000C601}3756C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099032Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.927{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC4A-60B9-9501-00000000C601}3756C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099031Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:50.928{38D812B3-DC4A-60B9-9501-00000000C601}3756C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157394Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.990{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73FFA49BB8F1D5B8BB66D684666525B1,SHA256=128C102D791987B959A544A63AB3604D25029A9059B9A478C15EDC341F885016,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099061Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.926{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=E8D2642C23DE665FBCA3CD6131896BEB,SHA256=4CA6A52FA2C55F480469C48844C9EE1C02216D4347B2C44823550FDC70A4345B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099060Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.723{38D812B3-DC4B-60B9-9601-00000000C601}33963368C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099059Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC4B-60B9-9601-00000000C601}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099058Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099057Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099056Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099055Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099054Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099053Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099052Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099051Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099050Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099049Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DC4B-60B9-9601-00000000C601}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099048Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.598{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC4B-60B9-9601-00000000C601}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099047Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.599{38D812B3-DC4B-60B9-9601-00000000C601}3396C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000099046Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:48.471{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50198-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000099045Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.067{38D812B3-DC4A-60B9-9501-00000000C601}37562020C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x800000000000000099044Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:51.020{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F1D559BE6E32513222EA9972F740CF75,SHA256=609B1DF0CC6B95D48FFA585DD6C34994956246DE04871E16242E714D5CC01617,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157393Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:49.494{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58030-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157392Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.646{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B255FEEA58699208B7B2359535FC6282,SHA256=B9AEC66D5FCEF0ABD3A4781C1B098B750C98A05F54287F5C77D4B753C462EEB3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157391Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.646{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=90B4D648E7DE60F76120205A278844C0,SHA256=FB3CB2380B74B6D51324B6F4CC923F78E3E90BABC4A42A16299612808D7F3E20,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157390Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.615{27B03E6B-D625-60B9-F500-00000000C501}50245104C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b3175|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157389Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.615{27B03E6B-D625-60B9-F500-00000000C501}50245104C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b308e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157388Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.615{27B03E6B-D625-60B9-F500-00000000C501}50245104C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b3057|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157387Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.615{27B03E6B-D624-60B9-EE00-00000000C501}45404648C:\Windows\system32\taskhostw.exe{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d832|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157386Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.615{27B03E6B-D624-60B9-EE00-00000000C501}45404648C:\Windows\system32\taskhostw.exe{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\MSCTF.dll+af11|C:\Windows\System32\MSCTF.dll+b489|C:\Windows\System32\MSCTF.dll+be73|C:\Windows\System32\MSCTF.dll+3d832|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157385Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.615{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b3175|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157384Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.615{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b308e|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157383Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.615{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b3057|C:\Windows\Explorer.EXE+1e03a|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157382Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.599{27B03E6B-D625-60B9-F500-00000000C501}50244764C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\Explorer.EXE+1f054|C:\Windows\Explorer.EXE+1f000|C:\Windows\Explorer.EXE+1dfec|C:\Windows\Explorer.EXE+1e249|C:\Windows\Explorer.EXE+1df79|C:\Windows\Explorer.EXE+3c407|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157381Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.599{27B03E6B-D625-60B9-F500-00000000C501}50241564C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b2af0|C:\Windows\System32\TwinUI.dll+12d4e1|C:\Windows\System32\TwinUI.dll+12dfcf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157380Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.599{27B03E6B-D625-60B9-F500-00000000C501}50241564C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+981b0|C:\Windows\System32\SHELL32.dll+b2aac|C:\Windows\System32\TwinUI.dll+12d4e1|C:\Windows\System32\TwinUI.dll+12dfcf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157379Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.599{27B03E6B-D625-60B9-F500-00000000C501}50241564C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b2a80|C:\Windows\System32\TwinUI.dll+12d4e1|C:\Windows\System32\TwinUI.dll+12dfcf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157378Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.599{27B03E6B-D625-60B9-F500-00000000C501}50241564C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\TwinUI.dll+12d319|C:\Windows\System32\TwinUI.dll+12dfcf|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157377Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.490{27B03E6B-DC4A-60B9-BD01-00000000C501}6120ATTACKRANGE\AdministratorC:\Temp\release\x32\x32dbg.exeC:\Temp\release\x32\x32dbg.iniMD5=3848E81A8FCBC16FB66ED5427CE406D8,SHA256=0F02550775C2AD7128C31173126438BFE796D7E34F44EBA45AA78B74B5ECCBD6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157376Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.130{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\rpcss.dll+5296|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+22b4b|C:\Windows\System32\RPCRT4.dll+653fa|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157375Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.052{27B03E6B-D3AA-60B9-1600-00000000C501}12124224C:\Windows\system32\svchost.exe{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+235b|c:\windows\system32\themeservice.dll+1ed0|c:\windows\system32\themeservice.dll+2006|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157374Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:51.036{27B03E6B-D3AA-60B9-1600-00000000C501}12121256C:\Windows\system32\svchost.exe{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|c:\windows\system32\themeservice.dll+144a|c:\windows\system32\themeservice.dll+4175|c:\windows\system32\themeservice.dll+3379|c:\windows\system32\themeservice.dll+31a3|C:\Windows\system32\svchost.exe+1380|C:\Windows\System32\sechost.dll+14342|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099076Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.410{38D812B3-DC4C-60B9-9701-00000000C601}8001944C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099075Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC4C-60B9-9701-00000000C601}800C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099074Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099073Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099072Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099071Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099070Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099069Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099068Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099067Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099066Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099065Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DC4C-60B9-9701-00000000C601}800C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099064Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.270{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC4C-60B9-9701-00000000C601}800C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099063Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.271{38D812B3-DC4C-60B9-9701-00000000C601}800C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099062Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:52.020{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FE6C49650A89956C529A4B21B8B9A895,SHA256=A85D738E279CCCBC135E00DFD3F332CF436B91BA53ECD2615691DAF8330E1D0A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157403Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.958{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157402Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.943{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1fc76f(wow64)|C:\Windows\System32\windows.storage.dll+1fc636(wow64)|C:\Windows\System32\windows.storage.dll+1fc38b(wow64)|C:\Windows\System32\windows.storage.dll+1fc456(wow64)|C:\Windows\System32\windows.storage.dll+1fc125(wow64)|C:\Windows\System32\windows.storage.dll+124c6e(wow64)|C:\Windows\System32\windows.storage.dll+125fc6(wow64)|C:\Windows\System32\windows.storage.dll+1266cd(wow64)|C:\Windows\system32\explorerframe.dll+65aad(wow64)|C:\Windows\system32\explorerframe.dll+65dfa(wow64)|C:\Windows\system32\explorerframe.dll+96782(wow64) 10341000x8000000000000000157401Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.943{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1fc6be(wow64)|C:\Windows\System32\windows.storage.dll+1fc636(wow64)|C:\Windows\System32\windows.storage.dll+1fc38b(wow64)|C:\Windows\System32\windows.storage.dll+1fc456(wow64)|C:\Windows\System32\windows.storage.dll+1fc125(wow64)|C:\Windows\System32\windows.storage.dll+124c6e(wow64)|C:\Windows\System32\windows.storage.dll+125fc6(wow64)|C:\Windows\System32\windows.storage.dll+1266cd(wow64)|C:\Windows\system32\explorerframe.dll+65aad(wow64)|C:\Windows\system32\explorerframe.dll+65dfa(wow64)|C:\Windows\system32\explorerframe.dll+96782(wow64) 10341000x8000000000000000157400Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.943{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1fc6a7(wow64)|C:\Windows\System32\windows.storage.dll+1fc636(wow64)|C:\Windows\System32\windows.storage.dll+1fc38b(wow64)|C:\Windows\System32\windows.storage.dll+1fc456(wow64)|C:\Windows\System32\windows.storage.dll+1fc125(wow64)|C:\Windows\System32\windows.storage.dll+124c6e(wow64)|C:\Windows\System32\windows.storage.dll+125fc6(wow64) 10341000x8000000000000000157399Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.943{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1fc6a7(wow64)|C:\Windows\System32\windows.storage.dll+1fc636(wow64)|C:\Windows\System32\windows.storage.dll+1fc38b(wow64)|C:\Windows\System32\windows.storage.dll+1fc456(wow64)|C:\Windows\System32\windows.storage.dll+1fc125(wow64)|C:\Windows\System32\windows.storage.dll+124c6e(wow64)|C:\Windows\System32\windows.storage.dll+125fc6(wow64)|C:\Windows\System32\windows.storage.dll+1266cd(wow64) 10341000x8000000000000000157398Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.458{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+2995e(wow64)|C:\Windows\System32\shcore.dll+29cab(wow64)|C:\Windows\System32\SHELL32.dll+1a7ded(wow64)|C:\Windows\System32\SHELL32.dll+18bc87(wow64)|C:\Windows\System32\SHELL32.dll+18babe(wow64)|C:\Windows\System32\SHELL32.dll+1aa3a6(wow64)|C:\Windows\System32\COMDLG32.dll+1f2e9(wow64)|C:\Temp\release\x32\platforms\qwindows.dll+2e51b(wow64) 10341000x8000000000000000157397Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.458{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+1a7ddf(wow64)|C:\Windows\System32\SHELL32.dll+18bc87(wow64)|C:\Windows\System32\SHELL32.dll+18babe(wow64)|C:\Windows\System32\SHELL32.dll+1aa3a6(wow64)|C:\Windows\System32\COMDLG32.dll+1f2e9(wow64)|C:\Temp\release\x32\platforms\qwindows.dll+2e51b(wow64) 10341000x8000000000000000157396Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.458{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+1a7ddf(wow64)|C:\Windows\System32\SHELL32.dll+18bc87(wow64)|C:\Windows\System32\SHELL32.dll+18babe(wow64)|C:\Windows\System32\SHELL32.dll+1aa3a6(wow64)|C:\Windows\System32\COMDLG32.dll+1f2e9(wow64)|C:\Temp\release\x32\platforms\qwindows.dll+2e51b(wow64) 23542300x8000000000000000157395Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.021{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0425471F05A30F5F0C961D0CB3CB9578,SHA256=7AEE908E374ACEAE8BCB2E1CE5A843649787DA7F3CC6FA3BE7B349CAED757306,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099078Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:53.503{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=20764E2FD8496517F03EC7AA59908567,SHA256=6AD1D9DD5F69BCB2EA43F584FAB0A32292E5C74C734029F5025FD0C533B6CBA6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099077Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:53.019{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=259CD133B3CB2E9FAB90D97165368D30,SHA256=02593F10F7DDE0FE4CFABF7D2B23885A181652DA12B907B3621E271AFFBC436E,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157468Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.443{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157467Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.443{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b554(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+fef20(wow64)|C:\Windows\System32\SHELL32.dll+fee56(wow64)|C:\Windows\System32\SHELL32.dll+fefe2(wow64)|C:\Windows\system32\explorerframe.dll+4b1ba(wow64)|C:\Windows\System32\USER32.dll+2d2d3(wow64)|C:\Windows\System32\USER32.dll+d30a(wow64) 10341000x8000000000000000157466Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.443{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b4cd(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+fef20(wow64)|C:\Windows\System32\SHELL32.dll+fee56(wow64)|C:\Windows\System32\SHELL32.dll+fefe2(wow64)|C:\Windows\system32\explorerframe.dll+4b1ba(wow64)|C:\Windows\System32\USER32.dll+2d2d3(wow64)|C:\Windows\System32\USER32.dll+d30a(wow64) 10341000x8000000000000000157465Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.443{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+fef20(wow64)|C:\Windows\System32\SHELL32.dll+fee56(wow64) 10341000x8000000000000000157464Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.443{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+fef20(wow64)|C:\Windows\System32\SHELL32.dll+fee56(wow64)|C:\Windows\System32\SHELL32.dll+fefe2(wow64) 23542300x8000000000000000157463Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.333{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8487DD6B1C816130E8FC8BBADB3AE548,SHA256=4A655D399A34552CC15D0A2343BEC489ED272C04DAAEA8C2B4883AEE89E62A76,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157462Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.271{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157461Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.271{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157460Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.271{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157459Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.271{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157458Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.271{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157457Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.271{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157456Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.271{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157455Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.271{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157454Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.255{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157453Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.255{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157452Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.255{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157451Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.255{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 734700x8000000000000000157450Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.224{27B03E6B-D3BA-60B9-2C00-00000000C501}2960C:\Windows\System32\dfssvc.exeC:\Windows\System32\cryptdll.dll10.0.14393.2969 (rs1_release.190503-1820)Cryptography ManagerMicrosoft® Windows® Operating SystemMicrosoft Corporationcryptdll.dllMD5=4B31902F1E0B79CE7E46D9877647C1CC,SHA256=8925892119315293C49D09A26191149660934BF1E5D3D023722E90339ADA38AA,IMPHASH=CAB6D6025DF08B0D0BC6259D625E2778trueMicrosoft WindowsValid 10341000x8000000000000000157449Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157448Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157447Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157446Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 23542300x800000000000000099092Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.023{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=085CC151B3CB36B536C2FF16ED6146A6,SHA256=432FACB7D0E4A520ADD0737EDA7535AC87C86A4C77261EC554FDCD6AFE7384AF,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157445Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-D3A7-60B9-0B00-00000000C501}640688C:\Windows\system32\lsass.exe{27B03E6B-D3BA-60B9-2C00-00000000C501}2960C:\Windows\system32\dfssvc.exe0x1478C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\lsasrv.dll+24c07|C:\Windows\system32\lsasrv.dll+25d4d|C:\Windows\system32\lsasrv.dll+24a85|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157444Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-D3A7-60B9-0B00-00000000C501}640688C:\Windows\system32\lsass.exe{27B03E6B-D3BA-60B9-2C00-00000000C501}2960C:\Windows\system32\dfssvc.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6cc4|C:\Windows\System32\RPCRT4.dll+67d2f|C:\Windows\system32\lsasrv.dll+249cd|C:\Windows\SYSTEM32\SspiSrv.dll+11a2|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157443Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157442Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157441Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157440Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157439Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157438Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157437Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157436Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157435Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157434Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157433Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157432Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157431Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157430Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157429Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157428Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157427Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157426Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157425Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157424Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157423Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157422Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157421Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157420Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.208{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AB4C72)|UNKNOWN(FFFF868DD0AB756B)|UNKNOWN(FFFF868DD0AA42EC)|UNKNOWN(FFFF868DD0A6220B)|UNKNOWN(FFFF868DD0A62176)|UNKNOWN(FFFF868DD0A62087)|UNKNOWN(FFFF868DD0A6206E)|UNKNOWN(FFFF868DD0A61758)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+f934|C:\Windows\System32\wow64win.dll+b9cf|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87 10341000x8000000000000000157419Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.068{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157418Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.068{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b554(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+837ce(wow64)|C:\Windows\system32\explorerframe.dll+81e64(wow64)|C:\Windows\system32\explorerframe.dll+87703(wow64)|C:\Windows\system32\explorerframe.dll+89a37(wow64)|C:\Windows\System32\USER32.dll+2d2d3(wow64)|C:\Windows\System32\USER32.dll+d30a(wow64) 10341000x8000000000000000157417Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.068{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b4cd(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+837ce(wow64)|C:\Windows\system32\explorerframe.dll+81e64(wow64)|C:\Windows\system32\explorerframe.dll+87703(wow64)|C:\Windows\system32\explorerframe.dll+89a37(wow64)|C:\Windows\System32\USER32.dll+2d2d3(wow64)|C:\Windows\System32\USER32.dll+d30a(wow64) 10341000x8000000000000000157416Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.068{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+837ce(wow64)|C:\Windows\system32\explorerframe.dll+81e64(wow64) 10341000x8000000000000000157415Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.068{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+837ce(wow64)|C:\Windows\system32\explorerframe.dll+81e64(wow64)|C:\Windows\system32\explorerframe.dll+87703(wow64) 10341000x8000000000000000157414Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.068{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157413Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.068{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 23542300x8000000000000000157412Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.052{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88A07B95CDC5C829727A9C3B6A3A2F1D,SHA256=99D2A5A1166E4FB4059FCFDEC60B930A9AA75C35F8C5DD73DBA5C5DA58136ECB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157411Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.021{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b554(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+7d5a5(wow64)|C:\Windows\system32\explorerframe.dll+7d526(wow64)|C:\Windows\system32\explorerframe.dll+7ee52(wow64)|C:\Windows\system32\explorerframe.dll+9217c(wow64)|C:\Windows\system32\explorerframe.dll+8eecd(wow64)|C:\Windows\System32\COMDLG32.dll+3459f(wow64) 10341000x8000000000000000157410Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.021{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b4cd(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+7d5a5(wow64)|C:\Windows\system32\explorerframe.dll+7d526(wow64)|C:\Windows\system32\explorerframe.dll+7ee52(wow64)|C:\Windows\system32\explorerframe.dll+9217c(wow64)|C:\Windows\system32\explorerframe.dll+8eecd(wow64)|C:\Windows\System32\COMDLG32.dll+3459f(wow64) 10341000x8000000000000000157409Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.021{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+7d5a5(wow64)|C:\Windows\system32\explorerframe.dll+7d526(wow64) 10341000x8000000000000000157408Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.021{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+7d5a5(wow64)|C:\Windows\system32\explorerframe.dll+7d526(wow64)|C:\Windows\system32\explorerframe.dll+7ee52(wow64) 10341000x8000000000000000157407Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.021{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b554(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+9a740(wow64)|C:\Windows\system32\explorerframe.dll+89593(wow64)|C:\Windows\system32\explorerframe.dll+892ca(wow64)|C:\Windows\system32\explorerframe.dll+8813f(wow64)|C:\Windows\system32\explorerframe.dll+88204(wow64)|C:\Windows\System32\SHELL32.dll+c05e2(wow64) 10341000x8000000000000000157406Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.021{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b4cd(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+9a740(wow64)|C:\Windows\system32\explorerframe.dll+89593(wow64)|C:\Windows\system32\explorerframe.dll+892ca(wow64)|C:\Windows\system32\explorerframe.dll+8813f(wow64)|C:\Windows\system32\explorerframe.dll+88204(wow64)|C:\Windows\System32\SHELL32.dll+c05e2(wow64) 10341000x8000000000000000157405Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.021{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+9a740(wow64)|C:\Windows\system32\explorerframe.dll+89593(wow64) 10341000x8000000000000000157404Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:54.021{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+9a740(wow64)|C:\Windows\system32\explorerframe.dll+89593(wow64)|C:\Windows\system32\explorerframe.dll+892ca(wow64) 10341000x800000000000000099091Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC4E-60B9-9801-00000000C601}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099090Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099089Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099088Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099087Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099086Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099085Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099084Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099083Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099082Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099081Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DC4E-60B9-9801-00000000C601}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099080Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.002{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC4E-60B9-9801-00000000C601}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099079Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:54.003{38D812B3-DC4E-60B9-9801-00000000C601}3616C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000157496Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157495Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b554(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+fef20(wow64)|C:\Windows\System32\SHELL32.dll+fee56(wow64)|C:\Windows\System32\SHELL32.dll+fefe2(wow64)|C:\Windows\system32\explorerframe.dll+4b1ba(wow64)|C:\Windows\System32\USER32.dll+2d2d3(wow64)|C:\Windows\System32\USER32.dll+d30a(wow64) 10341000x8000000000000000157494Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b4cd(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+fef20(wow64)|C:\Windows\System32\SHELL32.dll+fee56(wow64)|C:\Windows\System32\SHELL32.dll+fefe2(wow64)|C:\Windows\system32\explorerframe.dll+4b1ba(wow64)|C:\Windows\System32\USER32.dll+2d2d3(wow64)|C:\Windows\System32\USER32.dll+d30a(wow64) 10341000x8000000000000000157493Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+fef20(wow64)|C:\Windows\System32\SHELL32.dll+fee56(wow64) 10341000x8000000000000000157492Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+fef20(wow64)|C:\Windows\System32\SHELL32.dll+fee56(wow64)|C:\Windows\System32\SHELL32.dll+fefe2(wow64) 354300x8000000000000000157491Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.634{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58033-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 354300x8000000000000000157490Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.634{27B03E6B-D3BA-60B9-2C00-00000000C501}2960C:\Windows\System32\dfssvc.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58033-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 354300x8000000000000000157489Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.620{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58032-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 354300x8000000000000000157488Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.620{27B03E6B-D3BA-60B9-2C00-00000000C501}2960C:\Windows\System32\dfssvc.exeNT AUTHORITY\SYSTEMtcptruetruefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local58032-truefe80:0:0:0:bd75:ad73:67db:a425win-dc-819.attackrange.local389ldap 10341000x8000000000000000157487Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.633{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157486Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.633{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b554(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+7d5a5(wow64)|C:\Windows\system32\explorerframe.dll+7d526(wow64)|C:\Windows\system32\explorerframe.dll+7ee52(wow64)|C:\Windows\system32\explorerframe.dll+9217c(wow64)|C:\Windows\system32\explorerframe.dll+8eecd(wow64)|C:\Windows\System32\COMDLG32.dll+3459f(wow64) 10341000x8000000000000000157485Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.633{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b4cd(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+7d5a5(wow64)|C:\Windows\system32\explorerframe.dll+7d526(wow64)|C:\Windows\system32\explorerframe.dll+7ee52(wow64)|C:\Windows\system32\explorerframe.dll+9217c(wow64)|C:\Windows\system32\explorerframe.dll+8eecd(wow64)|C:\Windows\System32\COMDLG32.dll+3459f(wow64) 10341000x8000000000000000157484Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.633{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+7d5a5(wow64)|C:\Windows\system32\explorerframe.dll+7d526(wow64) 10341000x8000000000000000157483Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.633{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\system32\explorerframe.dll+7d5a5(wow64)|C:\Windows\system32\explorerframe.dll+7d526(wow64)|C:\Windows\system32\explorerframe.dll+7ee52(wow64) 10341000x8000000000000000157482Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.617{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157481Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.617{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+1ccb|C:\Windows\SYSTEM32\ntdll.dll+a9814|UNKNOWN(FFFFF80180A5E8C8)|UNKNOWN(FFFF868DD0AB4A68)|UNKNOWN(FFFF868DD0AAF715)|UNKNOWN(FFFF868DD0AB0C3A)|UNKNOWN(FFFF868DD0AFF1B5)|UNKNOWN(FFFFF80180775E03)|C:\Windows\System32\wow64win.dll+11214|C:\Windows\System32\wow64win.dll+31ed0|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+18260|C:\Windows\System32\wow64win.dll+363dd|C:\Windows\SYSTEM32\ntdll.dll+a9814|C:\Windows\System32\wow64win.dll+f534|C:\Windows\System32\wow64win.dll+4e07 10341000x8000000000000000157480Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.617{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1fc76f(wow64)|C:\Windows\System32\windows.storage.dll+1fc636(wow64)|C:\Windows\System32\windows.storage.dll+1fc38b(wow64)|C:\Windows\System32\windows.storage.dll+1fc456(wow64)|C:\Windows\System32\windows.storage.dll+1fc125(wow64)|C:\Windows\System32\windows.storage.dll+124c6e(wow64)|C:\Windows\System32\windows.storage.dll+125fc6(wow64)|C:\Windows\System32\windows.storage.dll+1266cd(wow64)|C:\Windows\system32\explorerframe.dll+65aad(wow64)|C:\Windows\system32\explorerframe.dll+65dfa(wow64)|C:\Windows\system32\explorerframe.dll+96782(wow64) 10341000x8000000000000000157479Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.601{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\windows.storage.dll+1fc6be(wow64)|C:\Windows\System32\windows.storage.dll+1fc636(wow64)|C:\Windows\System32\windows.storage.dll+1fc38b(wow64)|C:\Windows\System32\windows.storage.dll+1fc456(wow64)|C:\Windows\System32\windows.storage.dll+1fc125(wow64)|C:\Windows\System32\windows.storage.dll+124c6e(wow64)|C:\Windows\System32\windows.storage.dll+125fc6(wow64)|C:\Windows\System32\windows.storage.dll+1266cd(wow64)|C:\Windows\system32\explorerframe.dll+65aad(wow64)|C:\Windows\system32\explorerframe.dll+65dfa(wow64)|C:\Windows\system32\explorerframe.dll+96782(wow64) 10341000x8000000000000000157478Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.601{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1fc6a7(wow64)|C:\Windows\System32\windows.storage.dll+1fc636(wow64)|C:\Windows\System32\windows.storage.dll+1fc38b(wow64)|C:\Windows\System32\windows.storage.dll+1fc456(wow64)|C:\Windows\System32\windows.storage.dll+1fc125(wow64)|C:\Windows\System32\windows.storage.dll+124c6e(wow64)|C:\Windows\System32\windows.storage.dll+125fc6(wow64) 10341000x8000000000000000157477Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.601{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\windows.storage.dll+1fc6a7(wow64)|C:\Windows\System32\windows.storage.dll+1fc636(wow64)|C:\Windows\System32\windows.storage.dll+1fc38b(wow64)|C:\Windows\System32\windows.storage.dll+1fc456(wow64)|C:\Windows\System32\windows.storage.dll+1fc125(wow64)|C:\Windows\System32\windows.storage.dll+124c6e(wow64)|C:\Windows\System32\windows.storage.dll+125fc6(wow64)|C:\Windows\System32\windows.storage.dll+1266cd(wow64) 10341000x8000000000000000157476Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.601{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b554(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+2d561e(wow64)|C:\Windows\System32\SHELL32.dll+1d8508(wow64)|C:\Windows\System32\COMDLG32.dll+714f4(wow64)|C:\Windows\System32\SHELL32.dll+35ac74(wow64)|C:\Windows\system32\explorerframe.dll+ea982(wow64)|C:\Windows\system32\explorerframe.dll+ed2da(wow64) 10341000x8000000000000000157475Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.601{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+26498(wow64)|C:\Windows\System32\shcore.dll+230fc(wow64)|C:\Windows\System32\SHELL32.dll+18b4cd(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+2d561e(wow64)|C:\Windows\System32\SHELL32.dll+1d8508(wow64)|C:\Windows\System32\COMDLG32.dll+714f4(wow64)|C:\Windows\System32\SHELL32.dll+35ac74(wow64)|C:\Windows\system32\explorerframe.dll+ea982(wow64)|C:\Windows\system32\explorerframe.dll+ed2da(wow64) 10341000x8000000000000000157474Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.601{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+264da(wow64)|C:\Windows\System32\shcore.dll+297f0(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+2d561e(wow64)|C:\Windows\System32\SHELL32.dll+1d8508(wow64) 10341000x8000000000000000157473Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.601{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-D625-60B9-F500-00000000C501}5024C:\Windows\Explorer.EXE0x40C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+124f4|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecfc(wow64)|C:\Windows\System32\KERNELBASE.dll+c69b8(wow64)|C:\Windows\System32\shcore.dll+2983c(wow64)|C:\Windows\System32\shcore.dll+297cb(wow64)|C:\Windows\System32\shcore.dll+299c5(wow64)|C:\Windows\System32\shcore.dll+29d58(wow64)|C:\Windows\System32\shcore.dll+29dc5(wow64)|C:\Windows\System32\SHELL32.dll+18b4b6(wow64)|C:\Windows\System32\SHELL32.dll+18b648(wow64)|C:\Windows\System32\SHELL32.dll+18ba6d(wow64)|C:\Windows\System32\SHELL32.dll+18ba17(wow64)|C:\Windows\System32\SHELL32.dll+18bd97(wow64)|C:\Windows\System32\SHELL32.dll+2d561e(wow64)|C:\Windows\System32\SHELL32.dll+1d8508(wow64)|C:\Windows\System32\COMDLG32.dll+714f4(wow64) 23542300x8000000000000000157472Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.474{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=B255FEEA58699208B7B2359535FC6282,SHA256=B9AEC66D5FCEF0ABD3A4781C1B098B750C98A05F54287F5C77D4B753C462EEB3,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157471Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.602{27B03E6B-D3A5-60B9-0100-00000000C501}4SystemNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58031-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local445microsoft-ds 354300x8000000000000000157470Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.602{27B03E6B-D3A5-60B9-0100-00000000C501}4SystemNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58031-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local445microsoft-ds 23542300x8000000000000000157469Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.052{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F00C39E4424797B135C9FFA2A70D21B0,SHA256=DE31480A8F552C5F7DF1F8722A04F929BF9215F3A7F97F8DF01E9D3A0CC388C8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099095Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:53.564{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50199-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099094Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:55.033{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=63EFCD9D3099C43136603A2EF99A2AA8,SHA256=1E3D9DCF2DBA754542CAC0DE42F2B6030FDC1F50B91EB5D2A7C9E605DAA2BD53,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099093Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:55.033{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=367689F46BA865F9AEC93B2F22D78319,SHA256=DFF19A95AEE35A09C723C0ACED2DC38A2A7BE389201D0E540D124D64AAF21951,IMPHASH=00000000000000000000000000000000falsetrue 22542200x8000000000000000157498Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:53.618{27B03E6B-D3BA-60B9-2C00-00000000C501}2960win-dc-819.attackrange.local0fe80::bd75:ad73:67db:a425;::ffff:10.0.1.14;C:\Windows\System32\dfssvc.exe 23542300x8000000000000000157497Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:56.086{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BCA6B0E6D79E1C822B23D4234753CF41,SHA256=04147F66F952FA9DACE32896F76967EEC8961F02808E2563143CA9F869790BD0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099096Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:56.048{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6DBD46C08C9E6DCB7250891EC967069E,SHA256=8D016FEFE139E011FF0DFA0D9E1221646DFFF6E842C4F875A890CBC44BB28FAE,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157500Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:55.481{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58034-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157499Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:57.098{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=289E9BA5AAE1CD7329473B623F228464,SHA256=09888A9F9054D09E92B6C4F4D3B4A11560466906FC23823E3A684AD982F97E69,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099097Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:57.048{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2181DDB7E2E8742F9A5DBC32C99B207,SHA256=ACB3AE6B9F907646A9CFB240DCDEFFACB08E729752650F3858A51B2EE248D377,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099098Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:58.063{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5EB228F6E40C14E0AF37CB46048CCEA1,SHA256=6066A95A541882E5F252F62E44BA47FAD6423341B26B88775967197F44BA2A54,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157565Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.992{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157564Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.976{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157563Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.976{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157562Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.976{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157561Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.976{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x8000000000000000157560Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.976{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=80E672E5989DA5F120B3305AB3B34918,SHA256=5BCF111D39FADE929E0CA5844B23A62EB0C0F486F49617ED4189DA1D8312A6D1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157559Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.976{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157558Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.961{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157557Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.961{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157556Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157555Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157554Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157553Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157552Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157551Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157550Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.945{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2ca0(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2c22(wow64)|C:\Windows\System32\KERNELBASE.dll+155f96(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157549Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.929{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157548Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.929{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157547Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.929{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157546Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.929{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157545Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.929{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2ca0(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2c22(wow64)|C:\Windows\System32\KERNELBASE.dll+155f96(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157544Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.929{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157543Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.929{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157542Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.929{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157541Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.914{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157540Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.914{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157539Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.914{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157538Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.914{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2ca0(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2c22(wow64)|C:\Windows\System32\KERNELBASE.dll+155f96(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157537Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.898{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157536Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.883{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157535Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157534Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157533Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.851{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157532Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157531Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157530Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157529Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157528Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157527Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.804{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157526Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.804{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157525Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.804{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157524Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.804{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Temp\release\x32\TitanEngine.dll+491c1(wow64)|C:\Temp\release\x32\x32dbg.dll+b6a0c(wow64)|C:\Temp\release\x32\x32gui.dll+191db4(wow64) 10341000x8000000000000000157523Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.804{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157522Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.804{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+176b7e(wow64)|C:\Temp\release\x32\Qt5Core.dll+1929a2(wow64) 10341000x8000000000000000157521Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.804{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157520Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.789{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157519Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.789{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157518Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.789{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157517Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.789{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2cf9(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2c22(wow64)|C:\Windows\System32\KERNELBASE.dll+155f96(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157516Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.789{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x12367bC:\Windows\SYSTEM32\ntdll.dll+a9404|C:\Windows\System32\wow64.dll+31e13|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157515Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157514Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157513Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-D622-60B9-E100-00000000C501}11484684C:\Windows\system32\csrss.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157512Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157511Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157510Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\wow64.dll+10c0b|C:\Windows\System32\wow64.dll+10499|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6f66c(wow64)|C:\Windows\System32\KERNELBASE.dll+d9148(wow64)|C:\Windows\System32\KERNELBASE.dll+d7e2c(wow64)|C:\Temp\release\x32\TitanEngine.dll+4de33(wow64)|C:\Temp\release\x32\x32dbg.dll+50bf2(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 154100x8000000000000000157509Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.770{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe-----"C:\Temp\conti.exe"C:\Temp\ATTACKRANGE\Administrator{27B03E6B-D623-60B9-31C4-0B0000000000}0xbc4312HighMD5=F49B9F0D5AEFAA1F6431C18774B83553,SHA256=59A9F0DE96EFF57768E995B296AE75778A232F30D95A7B7AB5048C621B50C66D,IMPHASH=165166DAF912EEEDE18349A7B86B5288{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe"C:\Temp\release\x32\x32dbg.exe" 10341000x8000000000000000157508Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-D3AA-60B9-1200-00000000C501}5085492C:\Windows\System32\svchost.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|c:\windows\system32\pcasvc.dll+ac96|c:\windows\system32\pcasvc.dll+aaf6|c:\windows\system32\pcasvc.dll+aab8|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157507Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-D625-60B9-F500-00000000C501}50245104C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b3175|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157506Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-D625-60B9-F500-00000000C501}50245104C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b308e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157505Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.758{27B03E6B-D625-60B9-F500-00000000C501}50245104C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b3057|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157504Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.711{27B03E6B-D625-60B9-F500-00000000C501}50245104C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b13af|C:\Windows\System32\SHELL32.dll+b3175|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157503Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.711{27B03E6B-D625-60B9-F500-00000000C501}50245104C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b308e|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157502Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.711{27B03E6B-D625-60B9-F500-00000000C501}50245104C:\Windows\Explorer.EXE{27B03E6B-DC4A-60B9-BD01-00000000C501}6120C:\Temp\release\x32\x32dbg.exe0x1000C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\System32\SHELL32.dll+b1604|C:\Windows\System32\SHELL32.dll+b3057|C:\Windows\Explorer.EXE+3c618|C:\Windows\Explorer.EXE+3c4a4|C:\Windows\Explorer.EXE+3c411|C:\Windows\System32\windows.storage.dll+13bd5f|C:\Windows\System32\windows.storage.dll+13aaeb|C:\Windows\System32\windows.storage.dll+13900f|C:\Windows\System32\SHCORE.dll+367a6|C:\Windows\SYSTEM32\ntdll.dll+39cf9|C:\Windows\SYSTEM32\ntdll.dll+1e88a|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157501Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.101{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=73DBD595B7F8BBBA171AEFA63CF94E17,SHA256=A4DD5D38ED7E75B268C1DE013E434034C867A27E34537B5DD719EC1D37DE38DB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157609Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.805{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157608Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.805{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157607Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.805{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157606Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.805{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x8000000000000000157605Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.758{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=48539D247360285ACC870D430F652088,SHA256=9D00A75DD379449A4B3257B8ABB5C20F0BA1ADFE760A78A43676C17220C5578D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157604Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.164{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3AF48B32E45074B1C325D81D18B53E38,SHA256=705B6EEB7B2C66E163700F500DA980426293BFB527998F067FC7CDD426EBD963,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099099Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:59.078{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5118CAB10759C43A5A71F6E1BB6AE26C,SHA256=6F152C8B52799BEF1AC8100B6FB39DFB561E87582C53ECDB7545411D01AFC557,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157603Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.070{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Temp\release\x32\TitanEngine.dll+491c1(wow64)|C:\Temp\release\x32\x32dbg.dll+b6a0c(wow64)|C:\Temp\release\x32\x32gui.dll+191db4(wow64) 23542300x8000000000000000157602Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.070{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3C1CF1B472DBF53EBED125D5BBE0BC14,SHA256=54AE180238F94DD14C2A39B78AB339FEACC5022272E764861502E063F0240763,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157601Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+176b7e(wow64)|C:\Temp\release\x32\Qt5Core.dll+1929a2(wow64) 10341000x8000000000000000157600Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+176b7e(wow64)|C:\Temp\release\x32\Qt5Core.dll+1929a2(wow64) 10341000x8000000000000000157599Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+176b7e(wow64)|C:\Temp\release\x32\Qt5Core.dll+1929a2(wow64) 10341000x8000000000000000157598Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+176b7e(wow64)|C:\Temp\release\x32\Qt5Core.dll+1929a2(wow64) 10341000x8000000000000000157597Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157596Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157595Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157594Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157593Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+176b7e(wow64)|C:\Temp\release\x32\Qt5Core.dll+1929a2(wow64) 10341000x8000000000000000157592Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+176b7e(wow64)|C:\Temp\release\x32\Qt5Core.dll+1929a2(wow64) 10341000x8000000000000000157591Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+176b7e(wow64)|C:\Temp\release\x32\Qt5Core.dll+1929a2(wow64) 10341000x8000000000000000157590Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+176b7e(wow64)|C:\Temp\release\x32\Qt5Core.dll+1929a2(wow64) 10341000x8000000000000000157589Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Temp\release\x32\TitanEngine.dll+491c1(wow64)|C:\Temp\release\x32\x32dbg.dll+b6a0c(wow64)|C:\Temp\release\x32\x32gui.dll+191db4(wow64) 10341000x8000000000000000157588Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157587Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157586Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157585Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.054{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157584Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.039{27B03E6B-DC4A-60B9-BD01-00000000C501}61205772C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Temp\release\x32\TitanEngine.dll+491c1(wow64)|C:\Temp\release\x32\x32dbg.dll+8a15c(wow64)|C:\Temp\release\x32\x32dbg.dll+520fb(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157583Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.039{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6c6af(wow64)|C:\Temp\release\x32\x32dbg.dll+4dd05(wow64)|C:\Temp\release\x32\TitanEngine.dll+3ee5d(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157582Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.039{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6c6af(wow64)|C:\Temp\release\x32\x32dbg.dll+4dd05(wow64)|C:\Temp\release\x32\TitanEngine.dll+3ee5d(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157581Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.039{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6c6af(wow64)|C:\Temp\release\x32\x32dbg.dll+4dd05(wow64)|C:\Temp\release\x32\TitanEngine.dll+3ee5d(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157580Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.039{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6c6af(wow64)|C:\Temp\release\x32\x32dbg.dll+4dd05(wow64)|C:\Temp\release\x32\TitanEngine.dll+3ee5d(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157579Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.039{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157578Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.039{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157577Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.039{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157576Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.023{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157575Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.023{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157574Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.023{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157573Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.023{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157572Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.008{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157571Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.008{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157570Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:59.008{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157569Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.992{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157568Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.992{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157567Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.992{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157566Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:54:58.992{27B03E6B-DC4A-60B9-BD01-00000000C501}61204144C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x10C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+320de|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+7066c(wow64)|C:\Windows\SYSTEM32\ntdll.dll+a2fbe(wow64)|C:\Windows\System32\KERNELBASE.dll+155f3d(wow64)|C:\Windows\System32\KERNELBASE.dll+155ee2(wow64)|C:\Temp\release\x32\TitanEngine.dll+3d4eb(wow64)|C:\Temp\release\x32\x32dbg.dll+51028(wow64)|C:\Temp\release\x32\x32dbg.dll+46fed(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157618Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157617Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157616Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157615Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157614Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.805{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157613Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.805{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157612Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.805{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157611Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.805{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157610Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.320{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=95BB33D4A751F10C53E2C0069BB02D54,SHA256=8E0F7D9DD3F41D80A41470ECE62F0A9AA044B22C1374B8218B0BE2A3588EB454,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099100Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:00.078{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CD16A0F992C8B6F5222C6D8F07EB17B0,SHA256=C678523A5FBBA64AD2F4F4632C5F790524761C8640E5E6691EF81E7159F3DFA2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157619Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:01.555{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A0B1B0CF58D7764EF325C3D46FCF3A32,SHA256=219D1CFDC0D0B05D647AA9DA165306D0B81AD8C50EDFCF9E0293702FC01101CB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099101Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:01.078{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=52E1A6252EB607B398649371473070E2,SHA256=3E9C5CCC4278AAC8AC6FE3D26EE2135F6AB158CE32DE473250C8549F2BE8CA7D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157628Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:02.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157627Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:02.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157626Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:02.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157625Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:02.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157624Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:02.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157623Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:02.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157622Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:02.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157621Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:02.820{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157620Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:02.570{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3575016A7269BCFEFBA0F0254575BF40,SHA256=A0CDEFB8CF118414241C920BDB13221D468B415EE20D6041F73867404DCFDFDF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099102Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:02.077{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D51CF931EB9C1CD31AFE86A02B0CDA2,SHA256=A3F3964B95B2338BAD7B9543BD2AE659AD5F2A02F96A3F1E463B9C89C5479099,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157631Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:00.637{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58035-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157630Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:03.570{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E2F8B81731AA38FDC1674F4DC68A7612,SHA256=C9E61109E44A02254A9BC99F1B7B3AFE32BC6307BD68CE299C2AAFE9BDDC7045,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099104Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:54:59.501{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50200-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099103Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:03.077{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BECB974735AEEB69C0A2937B3DE6E2C4,SHA256=E47B97F9968C9ED74425F6DCE7CEBA9875F8FCA6BA7AF3DF83A32E3CEB0AC0FB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157629Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:03.211{27B03E6B-D3AA-60B9-1100-00000000C501}380NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=D980C1D28EFFE68C7115B127F5D6B342,SHA256=BD7C29C04D76A1AFA705B48956522F441206C85E2641BA65C907FA0DF12E1E69,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157640Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:04.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157639Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:04.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157638Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:04.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157637Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:04.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157636Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:04.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157635Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:04.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157634Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:04.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157633Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:04.836{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157632Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:04.570{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=857A11BABFFC2F78DBF7B30C61EF9E7D,SHA256=8EE3452B13678A646CB44317A7A32330AB3E2AF38B797B7676DCF37C959ED68B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099105Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:04.076{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CB6BEB8F9BA6ACCB4908B885554631F2,SHA256=EBE24DA7A6432683587BB0ABE4018508515D2A6C109051FCF0F78E8CF4CB8684,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157641Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:05.586{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DB3B4D7FA5A0F0A88D5E944DDB1D77A9,SHA256=3FDB6B85C1E9462673C1536764E3F37A944BFCB5820510736FABC0BE9AB315AC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099106Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:05.076{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3AC3889B327CE43F70980701F71DCFCA,SHA256=DD5557A2544E38FAB0AA2B22B917796CA87AD2C233B83B3F8DE351FA91F27331,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157651Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.852{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157650Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.852{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157649Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.852{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157648Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.852{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157647Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.852{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157646Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.852{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157645Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.852{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157644Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.852{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157643Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.602{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=01BAC4A83ACBDA71EFB97A914BAE1312,SHA256=505E3B49855F36D46800C6EA35A6F2D5ED0B0365789AFD375E3ACEAAB5D48612,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099107Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:06.091{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=97F29D2220B0F9C35AEC7F96399C4F2D,SHA256=EE1A5971D598D2EF30D21C11D3222E99199C470E9E10F4D28D1DB2A7C773676C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157642Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:06.180{27B03E6B-D3BA-60B9-2A00-00000000C501}2856NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157654Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:05.636{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58037-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x8000000000000000157653Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:05.558{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58036-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x8000000000000000157652Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:07.602{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=64FED2A6DE16D63EDDAB6C3E48198A31,SHA256=3EA07C4005F887FDDAABAC89751946ACF46E30520AA2BC9A6CA450DB497E94E8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099108Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:07.091{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0DD48D6E494F273951ED39CD6032CAC4,SHA256=1F696810AC95C0EB0934C5D99CC7141B758DBE711F2A5ABF346DC7D7C9F419FA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157663Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:08.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157662Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:08.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157661Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:08.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157660Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:08.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157659Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:08.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157658Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:08.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157657Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:08.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157656Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:08.867{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157655Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:08.602{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D524B0DC455142AEA8997258DF43B4F,SHA256=8B2B75C10962AAB8895733246DE817EEB171902EF2D89278AD9A5AA2CD40CBEA,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099110Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:05.486{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50201-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099109Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:08.091{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2B5099A4409E2758848DB2628AC3E2D8,SHA256=1CEA547404770525D11BE23769FC7168AF54C8BA8AE822CE80594FFFBA483A34,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157664Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:09.680{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=359B6D3CC8ED747D9FBC87289BF5DEEE,SHA256=B1A14CD4A20B33C63981AD631C34D89FF3D76E59D707EEDF8D38C262B7D22DD6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099111Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:09.090{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CBDF9DF48012F74A5119B082F0E8AC7C,SHA256=9783DF0EF6B0FC583458115954374E5FCAEFB90D9DC918E20F66FC460CB4BE1F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157673Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:10.883{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157672Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:10.883{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157671Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:10.883{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157670Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:10.883{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157669Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:10.883{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157668Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:10.883{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157667Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:10.883{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157666Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:10.883{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157665Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:10.743{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=66AC16293732E40C433C98A480951C91,SHA256=542D15A421889DEC3A4921A8FF994457ABDCF94BF4E1D61A35B2ACAEB3CBDB77,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099112Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:10.105{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7CD5969F81C922B058C9E89F0380EB87,SHA256=9F50B563C4C805144F2EB597C197D7A08577D56305ABBDCE85F51C586C2B1E50,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157674Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:11.758{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4F47670568C26047922D6CE439C96DFC,SHA256=69AB005EC4BDF7F3DCBE2CE14C5C712D2E211B40FC33B05D866B36E421012952,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099113Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:11.105{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A0436B12C18AC9CB2C75F8D79FC74492,SHA256=9EB3499D356CD6DC854E1E258A65B1435A145C7279BF61E109F3CE63B5ED1AC8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157683Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:12.899{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157682Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:12.899{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157681Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:12.899{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157680Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:12.899{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157679Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:12.899{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157678Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:12.899{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157677Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:12.899{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157676Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:12.899{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157675Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:12.758{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=57237ADAC804BDCD14FC4346D575D62D,SHA256=7A0CE44335FA27FCA5F2EC8CBE2BC0F1BECB54CA789C78BC961509646DE4687D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099115Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:10.579{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50202-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099114Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:12.106{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=441AA8271B163B5213478882FFC3C45A,SHA256=A2E564A9A5732FCF32506A294484BEE8FF8D8CE3D4355C9E227854176C51FBC4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157684Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:13.758{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E27C8BBFFDF1004050BEC8C5FAC140DA,SHA256=9D14AAEF5C0B8E02E9120384B53AFFA7500CED57A0F7C58AC1EFAF40AE2E89F9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099116Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:13.119{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BDCBD05FD38A3EFC140CAC4A7C458FAC,SHA256=30F9FF7E1869ADC481C8BCFB3CEB8FF6794C9E7B6307BE05E816DC6BEADAD586,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157694Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:14.915{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157693Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:14.915{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157692Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:14.915{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157691Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:14.915{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157690Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:14.915{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157689Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:14.915{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157688Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:14.915{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157687Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:14.915{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157686Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:14.758{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4B4F72965B03363640A54374A3EC0E9,SHA256=A5F51FA26CD3B0E68EC8A599C02D5C0358C70D8A3477532D0778B8DCD927CF55,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099117Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:14.131{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A3B092559463B101652690DF80D600B,SHA256=B5903E240EA5D9C856F2D1C32E9B3F4C97D94438A298C8A18DADCD92B9A757CF,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157685Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:11.527{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58038-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157695Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:15.774{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=34BCAFAD73EB19C2CE3031C8AC048AAB,SHA256=C9335AE1CE8097227C45424E84C1C6FE4AADC021095F9DF75A4FFD62EA1725C5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099118Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:15.130{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BE8F88474F5E70BAF1D2C56B7A8778C1,SHA256=71845F1E1E19E423CCC6D62BE023AEE13C0963CD8DF018E9BE08953100CCF2B1,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157704Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:16.930{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157703Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:16.930{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157702Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:16.930{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157701Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:16.930{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 23542300x8000000000000000157700Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:16.930{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3028047153EE037509E147184F4BDDA3,SHA256=1DFC33332CF235337DD07BAC3C3EA6414E5A60AE8948BB3AF5AF379EC2D6EDBD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157699Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:16.930{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157698Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:16.930{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157697Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:16.930{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157696Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:16.930{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x800000000000000099119Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:16.130{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E5EE47468394F2832D22429C0E25FF54,SHA256=F5D888BE367F285259620F197F9C6ED23FA407006702B0F13D5CBA8CFF46EDD4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157705Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:17.977{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D633A4F0E918BEF7ADE6238283C47B93,SHA256=9A669748F9F968DD01EF0C83F1FF0A19ACBE9C821A1BB4DACD643589685847A9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099120Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:17.130{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=735FB468415CC1A3F6998909937940F4,SHA256=0928A0E248E96F84E08FA99AF3A7986548171665FFE38B0354D4C294B4F3370D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157714Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:18.977{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F03BF254DE3351D7CD62C0CD4E3D3BAE,SHA256=17B70D5A950636EC17BEEA0B4ECE79FB7A9730895C9D2DAA7C56724494656E13,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157713Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:18.946{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157712Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:18.946{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157711Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:18.946{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157710Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:18.946{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157709Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:18.946{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157708Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:18.946{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157707Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:18.946{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157706Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:18.946{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x800000000000000099121Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:18.145{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D6654EC3B842BAC6C08457AE2662D596,SHA256=A3604F443F408D2F5B1FF3FBCE27F7215A2A16DF75123E790DC95018B61FCB2A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099123Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:19.144{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=34DE6CDADFF62F5272CEDE83AE737366,SHA256=5A2D6668FD51795667157F752134D951B7A0962C8B042CC4A7B0E6503A47A71B,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099122Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:16.468{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50203-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099124Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:20.144{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0326DD304C11521DCE530CD3665FBF68,SHA256=34B2FBA5547D260E5186FEF3199C314260E5EBC287CC75BF1F153602CFA8D465,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157724Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:20.962{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157723Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:20.962{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157722Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:20.962{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157721Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:20.962{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157720Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:20.962{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157719Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:20.962{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157718Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:20.962{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157717Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:20.962{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157716Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:20.024{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=443EF1A981845B7674B7A5438D8FC7E0,SHA256=CCC1F1C8C1F495B26A7D40880576A4C4E88976271A7F77E8807459788FA09C2F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157715Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:17.417{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58039-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099125Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:21.144{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFDB404052B265B84B830D55428E814D,SHA256=6174A43705E4B105A55E49E6BF3593B619AF169C81E60EA4D938578C767E8EBB,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157725Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:21.024{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3967C0BF7B50643A82BE4FFC34F79EF5,SHA256=45481E0EE0C789CFCEC2E75D0ADB83F64B76C807EDACB47EF55DBA33703AC8A8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157737Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.977{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157736Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.977{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157735Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.977{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157734Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.977{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157733Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.977{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157732Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.977{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157731Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.977{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157730Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.977{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157729Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.181{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6A127764022C2123F213DC6435FCA799,SHA256=ECDBE1F415710B24EADB182DA9E284C068192947C05053FC84E4D45EB1FF08F0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099127Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:22.159{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8C2D9FFDA8823D83B721DA0F18BF47A6,SHA256=0A6922B4B8726E3C35531DE36BFC7FA97D57878A40C4DB05ED5581A4509F1B57,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099126Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:22.144{38D812B3-D3CB-60B9-1C00-00000000C601}1936NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157728Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.071{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1500-00000000C501}1204C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157727Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.071{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1500-00000000C501}1204C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157726Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:22.071{27B03E6B-D3A9-60B9-0C00-00000000C501}8365388C:\Windows\system32\svchost.exe{27B03E6B-D3AA-60B9-1500-00000000C501}1204C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157738Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:23.181{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07DCA8952CEBB7EC28184F819D4B6891,SHA256=DCF2984C6FA92340C17C6297E7ED09A44F49391E59E273AAFC4336CE4455B932,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099128Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:23.159{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=964A85485CC386219AB0ED4A3B5AD815,SHA256=F4D1BEC104ABCCBB756ED225B8FC3711080A0B7066589C55115C58FAA7E82B76,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099131Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:22.418{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50205-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 354300x800000000000000099130Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:21.465{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50204-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000099129Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:24.159{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=58DE3A7C3D58214E623F5A58D395EA5C,SHA256=DC18E7E7DF34D33F6EBA4F9D1E3C0B57998DEDDDB6A9969714BDCB01E6196AC9,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157749Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.993{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157748Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.993{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157747Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.993{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157746Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.993{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157745Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.993{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157744Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.993{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157743Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.993{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157742Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.993{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157741Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.712{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2D8ACE7B8FA69C51A939D46D7B7A9AAB,SHA256=478D2337D9D200E76ED06F4315D9D287C333946200A4E3012A7A0C0C763BAF46,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157740Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.712{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=5F41CAC2F5F6B4F1AC104ED7613B1D5B,SHA256=D13119DF96E074676443B3B90CC949B7C1AC281FC59D1E1141FF6121DB295DD4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157739Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:24.181{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=86846205BA775D26C28466D2A4491E1F,SHA256=79AF2863DE61921D6936CFCE9D7D15E7F1102FF72809671C0D3D0DF56E2E7F94,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099132Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:25.174{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C033ADC1CD63EE6EBA5F3F81784C43F2,SHA256=6DBF969A836213CC27CCD91892881F192EBF8CEF2F323410ADB13C24FA488181,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157750Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:25.181{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=278E10F917606CA5DE23C8BFB18FA815,SHA256=C78B0598D0D5497B35807FE54570722F967E491CD66A9743A4A22F1AA200F46A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157752Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:26.196{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2EBC4F378EEC3B3B1E089E10ECFB432B,SHA256=5CE7EC5323228ACE24D5DDD6E463C557D31754608C4F7CDAFA464EF346AF8116,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157751Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:23.433{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58040-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099133Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:26.174{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=241AA9B5B53A4B786F9BA165AF4D0A04,SHA256=694C51795706E449271EC91028953D4509EAE2F8F4A525562BA8FBC17E542622,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157761Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:27.259{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27A201BF6983E896F0AEAAD317EDA8BB,SHA256=EA1AD9C8A45D309AC756292693502C32E5F7D0DCB24AA4E154F4061B35817F93,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099134Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:27.173{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A3ED3A82F47649D34DD55AE7E607E65B,SHA256=DA6D33E54FC70C1DAA9FD23A2C5C07FBECCFC98498E25AEFC32F073BC86796FE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157760Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:27.009{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157759Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:27.009{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157758Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:27.009{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157757Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:27.009{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157756Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:27.009{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157755Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:27.009{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157754Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:27.009{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157753Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:27.009{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x800000000000000099135Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:28.173{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF4FD789040928E0F6271A463D598280,SHA256=10AA480A443EF7C0ABF7CE179B788146C37877B1D991DE34EEBC837AE83F198A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157762Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:28.259{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=16D84405A8C1ECFBDAFE55C794732541,SHA256=B2FFF2C14B09FD39E9946B1BCB3C8CF1BBC375E02B8C011E389D2E630A767AC4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099137Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:27.512{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50206-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099136Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:29.173{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C6A7D8B2D7DA7BCA1EE2D84D255F4B47,SHA256=C56857DBB4A9005DA8DB901A5339CAED7AEA670C75CE56FA95ADA631DC0F3B44,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157771Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:29.259{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C2BB94273F0CA30CF7504E917BF988FF,SHA256=D7F70A4A725D3E8AA88E4BCF2D2579860D078A91079F160157174E45B0BF15DE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157770Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:29.025{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157769Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:29.025{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157768Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:29.025{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157767Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:29.025{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157766Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:29.025{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157765Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:29.025{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157764Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:29.025{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157763Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:29.025{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157772Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:30.259{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F7A6DDDC0DB197EBE3043FA8FB1297D4,SHA256=822D7DB69964AA5773CE8A5D58170902953EECA4853C7B9CDF7187E57BDD2CAE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099138Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:30.172{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A996EE4975BCDDAA841FA6D261D32F3C,SHA256=24A510BBC60B2F848E66433EBF94A28CF7B8AD8065169C48A192EC2945FFF54E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099139Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:31.188{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=204107DF32B2A319E8A24FE178BAC2B2,SHA256=8A7EE9E7144629E14BFB6C722B0583516361CA3EB294E064A7F96027DC6F0D19,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157790Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.837{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC73-60B9-BF01-00000000C501}5372C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157789Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.837{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157788Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.837{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157787Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.837{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157786Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.837{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157785Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.837{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DC73-60B9-BF01-00000000C501}5372C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157784Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.837{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC73-60B9-BF01-00000000C501}5372C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157783Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.682{27B03E6B-DC73-60B9-BF01-00000000C501}5372C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157782Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.275{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FBA7CA6113B106D30DA59538AEDF5E8A,SHA256=E1FB6EE7B1A8153A98FBFB2E6F2B7AFC2FEF5A517AAD6C2EFCDDA2BBC045268E,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157781Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:28.542{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58041-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000157780Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.040{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157779Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.040{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157778Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.040{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157777Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.040{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157776Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.040{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157775Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.040{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157774Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.040{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157773Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.040{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x800000000000000099140Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:32.187{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8A4CC3B9560E774A5FE527320891D3CD,SHA256=FAE6382C7E816C6E0EB9F0511E8517EDB5F91EE652D885A501E595DBE6CA9420,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157801Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.931{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC74-60B9-C001-00000000C501}3404C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157800Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.931{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157799Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.931{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157798Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.931{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157797Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.931{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157796Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.931{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DC74-60B9-C001-00000000C501}3404C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157795Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.931{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC74-60B9-C001-00000000C501}3404C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157794Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.807{27B03E6B-DC74-60B9-C001-00000000C501}3404C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157793Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.681{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=831C920AC35727816BE644B1E498D466,SHA256=8AEABB23B3F8F009653F66C4BF00116DE36BDB3A7D8BAC371C0A90A52BB4ED4F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157792Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.681{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=2D8ACE7B8FA69C51A939D46D7B7A9AAB,SHA256=478D2337D9D200E76ED06F4315D9D287C333946200A4E3012A7A0C0C763BAF46,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157791Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:32.275{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=38C50F58D3C0733DE6A3237D5E984F82,SHA256=677A483716E7AA453D06C90BF55FC6F0BCBFFD1785CE2D94057FCE3DFF6DD2FD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099141Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:33.203{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C03B9D276CF7E0F3A94D339BB24CB1D4,SHA256=483E830E54606D6A766EAA193A99D211D65711857BDC4C886367F161E1F72138,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157820Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.931{27B03E6B-DC75-60B9-C101-00000000C501}54885612C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157819Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.853{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=831C920AC35727816BE644B1E498D466,SHA256=8AEABB23B3F8F009653F66C4BF00116DE36BDB3A7D8BAC371C0A90A52BB4ED4F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157818Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.744{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC75-60B9-C101-00000000C501}5488C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157817Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.744{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157816Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.744{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157815Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.744{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157814Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.744{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157813Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.744{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DC75-60B9-C101-00000000C501}5488C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157812Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.744{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC75-60B9-C101-00000000C501}5488C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157811Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.604{27B03E6B-DC75-60B9-C101-00000000C501}5488C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157810Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.275{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F578E618078BBF7259CF686C4AB8B1EE,SHA256=E12251B4AA71ED162BEA146B43DD6323DFFD940D8A6CC46F03606300D763CF69,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157809Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.056{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157808Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.056{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157807Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.056{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157806Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.056{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157805Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.056{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157804Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.056{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157803Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.056{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157802Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:33.056{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 354300x8000000000000000157823Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.855{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58042-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 354300x8000000000000000157822Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:31.855{27B03E6B-D3BA-60B9-2600-00000000C501}2784C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58042-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 23542300x8000000000000000157821Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:34.291{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DFA45B69DFEE1BBC6E86D535833FC3EA,SHA256=89B0EA5E841953F2502A1D0B023C4D4343B107A6C2EFEC41709B31A49886A00E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099142Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:34.218{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F472A9468383922C71E9192E3BB3A1CB,SHA256=935FEF90F52405E6446735493FA94475787B5BECAD26D872B7A9BB2A85C55016,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099144Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:35.592{38D812B3-D3CA-60B9-1300-00000000C601}96NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.datMD5=26BAFA39044585DC3A2E77502D1DF067,SHA256=20297B616868320B2CBAEE84E8C54B2E22233D103157EA5F3C8CA01ABE6ED84F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099143Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:35.217{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FC0944B66D514609E305CB48A0E78EA,SHA256=76B0AC3895B2377CEB87C1C4FB9A2A42CC13898DA6DA9805729CE547C118E6BA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157841Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.603{27B03E6B-DC77-60B9-C201-00000000C501}5640664C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157840Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.447{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC77-60B9-C201-00000000C501}5640C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157839Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.447{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157838Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.447{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157837Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.447{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157836Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.447{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157835Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.447{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DC77-60B9-C201-00000000C501}5640C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157834Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.447{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC77-60B9-C201-00000000C501}5640C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157833Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.322{27B03E6B-DC77-60B9-C201-00000000C501}5640C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157832Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.306{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=81DA7DEB8F1AE0A1DFEBC137710AC659,SHA256=9085B67C32E74E0B8AEEBE5D76284D8099AE8237177C4353B7153874771EC744,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157831Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.072{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157830Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.072{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157829Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.072{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157828Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.072{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157827Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.072{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157826Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.072{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157825Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.072{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157824Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:35.072{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 354300x800000000000000099146Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:33.512{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50207-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099145Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:36.217{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=54C4254BBFCE9B6DFB3AABA7AE1CFB5B,SHA256=8466B22583A03CC63400DBB42BC188C3A5A91E1E56BD168A0156273B15A014E6,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157860Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.791{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC78-60B9-C401-00000000C501}4232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157859Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.791{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157858Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.791{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157857Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.791{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157856Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.791{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157855Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.791{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DC78-60B9-C401-00000000C501}4232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157854Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.791{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC78-60B9-C401-00000000C501}4232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157853Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.792{27B03E6B-DC78-60B9-C401-00000000C501}4232C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157852Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.322{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DBA856E94DC6C40D41FF1780138BCCC,SHA256=28864EEEE125FFF1D80C80557620F470BC852CF54AC0213CEE29F9613A03083E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157851Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.322{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D8FFFDC04378989B28327B4B49E79926,SHA256=C25FB3B1CB3FD21F170F94BDF98AC1D846ACE7D9BFCABDAC1CCF1E90D0A66BD2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157850Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.306{27B03E6B-DC78-60B9-C301-00000000C501}56725688C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157849Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.119{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC78-60B9-C301-00000000C501}5672C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157848Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.119{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157847Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.119{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157846Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.119{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157845Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.119{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157844Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.119{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DC78-60B9-C301-00000000C501}5672C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157843Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.119{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC78-60B9-C301-00000000C501}5672C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157842Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:36.120{27B03E6B-DC78-60B9-C301-00000000C501}5672C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157872Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.916{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=86CD011CECEC8DAAEAD2314C25101517,SHA256=CEBA75A96469B15E1B9A1AC022064776C059386DE47B439F6C2B8EA8EC6999CD,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157871Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:34.464{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58043-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157870Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.322{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A1FFD4613D3C5DCC6A06DF809B348579,SHA256=74D090EF02E7CF78EA08AFB4B7AEAC5312973189BA81652067571575AFBC167E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099147Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:37.232{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C93ECDD929EDB10E474DD9354B8EB083,SHA256=461B7764BBE9D3B5070EEFAA3EA998C5312BE843CBE65D909F0FF81DC7B1D3CE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157869Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.087{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157868Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.087{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157867Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.087{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157866Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.087{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157865Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.087{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157864Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.087{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157863Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.087{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157862Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.087{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157861Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:37.009{27B03E6B-DC78-60B9-C401-00000000C501}42324332C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157881Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:38.509{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DC7A-60B9-C501-00000000C501}4820C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157880Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:38.509{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157879Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:38.509{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157878Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:38.509{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157877Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:38.509{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157876Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:38.509{27B03E6B-D3A7-60B9-0500-00000000C501}420388C:\Windows\system32\csrss.exe{27B03E6B-DC7A-60B9-C501-00000000C501}4820C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000157875Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:38.509{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DC7A-60B9-C501-00000000C501}4820C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000157874Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:38.510{27B03E6B-DC7A-60B9-C501-00000000C501}4820C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000157873Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:38.338{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=902CD42EEB80EBCB33A9B769F7AACC65,SHA256=22B7438DDB1FEF1B1A02D249780B0DCFE94EC9F375B206512E8AF79CAB607059,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099151Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:38.248{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53C8F79B3769860D312F0E613278601D,SHA256=C4640A8A0E21417EEA2EDA00C29B2801EACAB9721173062452345E82BFEB407A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099150Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:38.013{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CA-60B9-1600-00000000C601}1220C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099149Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:38.013{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CA-60B9-1600-00000000C601}1220C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099148Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:38.013{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CA-60B9-1600-00000000C601}1220C:\Windows\system32\svchost.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 23542300x8000000000000000157891Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.525{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=0C5501877A774C96B786B677DF36E674,SHA256=A4E210B2DD395BE649559C6F9CD1B7F69A2D6EAE73E06C5C0DEF25ADAF74460A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157890Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.447{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7A806313E13AEF7A159E769E390801AA,SHA256=DB211738DC447CCB4696FF6522BDD311152D9B4A64FC16D1960E6BA7ED1D0265,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099152Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:39.248{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B73757C314A42AFA25DF6F3EE5CDCC92,SHA256=B00747F247177ED9B3DBC05187EA552D121E859075A05AB2ECD0E24F08E28043,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157889Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.103{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157888Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.103{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157887Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.103{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157886Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.103{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157885Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.103{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157884Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.103{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157883Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.103{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157882Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:39.103{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157892Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:40.478{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED20292836E36E73D74BBE36D2C4E75F,SHA256=41B2ACC4C9E860A64DAC012BFFC70042B9C9A620A37436D842467F026B1F8C27,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099153Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:40.247{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=99A06F426487A207263FAF0F16AFCA2A,SHA256=AAD41A3192B49F7047E4622BD705C74C3BD98DBA6E93338FADC0F711B44B45A4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157901Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:41.494{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DD802A0C759EE0BE9661CC11418A4650,SHA256=C45B925DD27492285D0D9229D32AAB883D77D27D5820C01A1574CC9312DF105D,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099155Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:39.480{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50208-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099154Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:41.247{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4E7694A6EC5E43303FC963DF05F85D1A,SHA256=B2F41B523E6C8402711B739F952772EB75FBADA5F30A217D87ED7DF0FD38D2E8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157900Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:41.119{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157899Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:41.119{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157898Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:41.119{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157897Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:41.119{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157896Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:41.119{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157895Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:41.119{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157894Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:41.119{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157893Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:41.119{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157902Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:42.494{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7D6A740B460735F2784D6083962798DB,SHA256=7A5AE7EA97443430E92966AF06748E9ED48819D411C4E9C8FC9B486634812A13,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099156Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:42.262{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9CBC7AEDA46B6A9266CDD87517804D83,SHA256=7BC143AA9C43E1E664A996C7B3EDA381310A5D93B05A991C78585B3BFD30E0D3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157912Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:43.494{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=553643A8C455A18CA947212B103600B6,SHA256=AA1C62B782C3E7000F3EE45AD986BF780B0390514B02AF3D39F51F0CECB1D24A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099157Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:43.278{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=13A728D2CB8DBB922D31FB6E8DA064D7,SHA256=1BF74E99E0722BD2FCB8402A335BAB8DD02A9EA66DEF8B89991639E63C7C9919,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157911Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:40.433{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58044-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000157910Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:43.135{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157909Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:43.135{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157908Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:43.135{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157907Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:43.135{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157906Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:43.135{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157905Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:43.135{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157904Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:43.135{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157903Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:43.135{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157913Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:44.494{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FFF33DBAD397584C63AA70D14F2456CB,SHA256=AF1E12AA3BDF709702E633A36D1F1DA8C4C4CFB1C18A5F24E68C86EBB5852957,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099158Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:44.278{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F980115012B174D15183C1F504BCFCC1,SHA256=1ADE184D6E6A462842EC90DE7A900342FD918BFF10268C8296D87D1CBF0BF019,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157922Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:45.541{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=81702D0C53D5ADC51AD356EE02210C99,SHA256=03E38FF11CA31899042810CDE188E6DADF8A1C6B40963E6C7047ECC621AA2E28,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099159Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:45.277{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07645538DF20451757B230557CD2D789,SHA256=F225765B4FA9A82CB25EBB8BCF6B4D69D9447903011AA13876520754E0AA23E3,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157921Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:45.150{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157920Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:45.150{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157919Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:45.150{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157918Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:45.150{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157917Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:45.150{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157916Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:45.150{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157915Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:45.150{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157914Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:45.150{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157923Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:46.604{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C76A8C2AFFA8E1E1674285F7659FED78,SHA256=71A79FA883DF047C550D8300A570115CB64D9CB8037C059CDD935DC1927445C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099160Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:46.277{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=092879ADF33EB0F1BFCE5885B8214FF5,SHA256=1E257C09E6185F00D7D0D5FC8D206D81D35EA3148BA857E279B4D32693CA63B5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157932Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:47.635{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A93F16C93A080EC39F5A9CF268AD97A,SHA256=C5B72F58CF91DC434EE1DEB176FE6F099B57D3EBA53BBEBFC148CD0BAC023DA8,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099175Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:45.434{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50209-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000099174Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC83-60B9-9901-00000000C601}2660C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099173Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099172Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099171Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099170Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099169Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099168Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099167Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099166Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099165Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099164Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DC83-60B9-9901-00000000C601}2660C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099163Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.402{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC83-60B9-9901-00000000C601}2660C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099162Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.403{38D812B3-DC83-60B9-9901-00000000C601}2660C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099161Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:47.292{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DB5568091A5DA6301ABD8A409658D3B,SHA256=F1B6D3530427DD37ADCFB17DCCF1B1CD420E0B78052062346D76ECEA75F4A15C,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157931Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:47.166{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157930Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:47.166{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157929Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:47.166{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157928Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:47.166{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157927Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:47.166{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157926Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:47.166{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157925Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:47.166{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157924Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:47.166{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157933Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:48.650{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E7D3F80FA34D49F628E31F56C47D244A,SHA256=2D674E9E13BD80C882CE953C24989BE80FE5B6318D38957765E4B4474730FDA2,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099205Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC84-60B9-9B01-00000000C601}420C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099204Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099203Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099202Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099201Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099200Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099199Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099198Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099197Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099196Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099195Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DC84-60B9-9B01-00000000C601}420C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099194Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.776{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC84-60B9-9B01-00000000C601}420C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099193Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.777{38D812B3-DC84-60B9-9B01-00000000C601}420C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099192Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.589{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D171E0D97EBC8E5C1E057633B1032BA3,SHA256=563FF9903FD7350960646BFCB65BF5276D56953D5CCAC030B4D2746CC2310DF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099191Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.589{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=41F8F92689417505F55DE115381A99EF,SHA256=4F574A002EFD331EE8C4F9A4F68F19E4750EB75D978615ECBB05D581C9D16B7C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099190Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.589{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5CA093D2BF42B75AAC4ACD8EB433747A,SHA256=47CAC9E62FF01D33CDE212837D1E23CC1B8042AF734E9787459D8C4A861814FE,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099189Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.230{38D812B3-DC84-60B9-9A01-00000000C601}24683488C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099188Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC84-60B9-9A01-00000000C601}2468C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099187Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099186Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099185Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099184Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099183Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099182Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099181Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099180Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099179Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099178Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DC84-60B9-9A01-00000000C601}2468C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099177Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC84-60B9-9A01-00000000C601}2468C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099176Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:48.105{38D812B3-DC84-60B9-9A01-00000000C601}2468C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099207Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:49.823{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D171E0D97EBC8E5C1E057633B1032BA3,SHA256=563FF9903FD7350960646BFCB65BF5276D56953D5CCAC030B4D2746CC2310DF8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099206Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:49.605{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=286B94B7CC43F6FADE7B671B4CC0C9CE,SHA256=CBCDE137E6B2092AACB60B02D63B5EA1DF6D3F22A82E193ABFF91867D6D8FEE4,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157943Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:46.418{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58045-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157942Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:49.651{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=373716D862BDA8E956EF60F689A7DCC6,SHA256=9C164D3C4892F8DF49086AE6A1518CC316A470FCB43645ED1C7CED1683AB464A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157941Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:49.182{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157940Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:49.182{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157939Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:49.182{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157938Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:49.182{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157937Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:49.182{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157936Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:49.182{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157935Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:49.182{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157934Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:49.182{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x800000000000000099221Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC86-60B9-9C01-00000000C601}3168C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099220Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099219Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099218Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099217Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099216Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099215Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099214Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099213Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099212Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099211Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DC86-60B9-9C01-00000000C601}3168C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099210Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.901{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC86-60B9-9C01-00000000C601}3168C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099209Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.902{38D812B3-DC86-60B9-9C01-00000000C601}3168C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099208Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.854{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9DFE64648EE12CD89A840E53071238E0,SHA256=178579910B347574CDA0D270BB6BDE2E76655CBE286A670B286DFD59C29C448C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157944Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:50.666{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=46A81BA7AFD83ED38DC2EEBDF18AC7AF,SHA256=5E1DED7FA7102E4FAF23D3207C2C7A0950F3CBC64C401949C0E0B0BFC6EDFAAC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157953Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.682{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B695AACB6B91C8B52314CF450BF5F29A,SHA256=89FD4266683DAE152E273CC12F1C44EF7F95D8F1CCFCEDE23710B66A0009E90D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099236Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.713{38D812B3-DC87-60B9-9D01-00000000C601}9121196C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099235Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC87-60B9-9D01-00000000C601}912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099234Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099233Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099232Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099231Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099230Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099229Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099228Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099227Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099226Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099225Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DC87-60B9-9D01-00000000C601}912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099224Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.573{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC87-60B9-9D01-00000000C601}912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099223Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.574{38D812B3-DC87-60B9-9D01-00000000C601}912C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x800000000000000099222Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:51.026{38D812B3-DC86-60B9-9C01-00000000C601}31681180C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000157952Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.197{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157951Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.197{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157950Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.197{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157949Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.197{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157948Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.197{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157947Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.197{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157946Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.197{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157945Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.197{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157954Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:52.682{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BED086935F0D7C1EE2564D0B7B86FCEF,SHA256=428F28225BDE12DCD8E587379718E652CD913D1C5B9ED23F591ABCEC44F89153,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099253Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:50.527{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50210-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000099252Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.276{38D812B3-DC88-60B9-9E01-00000000C601}18922480C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099251Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC88-60B9-9E01-00000000C601}1892C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099250Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099249Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099248Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099247Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099246Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099245Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099244Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099243Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099242Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099241Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DC88-60B9-9E01-00000000C601}1892C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099240Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC88-60B9-9E01-00000000C601}1892C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099239Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.153{38D812B3-DC88-60B9-9E01-00000000C601}1892C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099238Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1189C132C91F47B4604A4C47F57418B0,SHA256=B13A33645EEA13CB8E65783423CF6EF259982B41AAEA0FE549E5A7F0D9ECCE18,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099237Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:52.151{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=778E25737E15419E882FFB7FD6203C0B,SHA256=ECE714E327F00F90A2DD5C173D20A8EE166819BFB079E5F426A01C72EE3E3018,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157964Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:53.698{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1A5C52CBCB2302FFA0BF06176D985817,SHA256=92E574CEC969A5A2A2BC05A285CE76FCC05171E6D2A21AF489DBE3E8678F6F95,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099268Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DC89-60B9-9F01-00000000C601}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099267Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099266Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099265Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099264Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099263Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099262Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099261Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099260Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099259Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099258Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DC89-60B9-9F01-00000000C601}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099257Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.983{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DC89-60B9-9F01-00000000C601}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099256Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.984{38D812B3-DC89-60B9-9F01-00000000C601}1572C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099255Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.166{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3D6C8B12F58E3C16B0916B728A2E8D3A,SHA256=57CE8B950768E737830F70857B09D4CDC0F9A3AA02B7903235AC8954314916D2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099254Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:53.166{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=13373DCDC2F7F39A79067AEAF85DF45D,SHA256=DA75F10CDF16E975F6DC4B70DD9565B4035DA7EC03D09CA3614BD43117282016,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157963Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:51.574{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58046-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000157962Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:53.213{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157961Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:53.213{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157960Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:53.213{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157959Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:53.213{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157958Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:53.213{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157957Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:53.213{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157956Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:53.213{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157955Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:53.213{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157965Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:54.713{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A848AE77220CEC9B51907415EE24670C,SHA256=F6B7D0257D83D7906C5E6CBE02909E19808C6221CBA33071B67B236546DCCBF1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099269Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:54.296{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=107A3BCBEA09D8AE0FB63D9138CCCCD2,SHA256=7BBE11FC4AF75C67A238EB6F00968FA09654317CE9C68EB983DADBC4B452D2C6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157974Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:55.713{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E5E28A646B46E72813C1B0019BC111B8,SHA256=8BD0840354F89C232B0E7916C641D23D1BE58B54D44E325138AE721CB018D425,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099271Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:55.342{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D139588EBC43359D21297E8EC49B06DB,SHA256=CEC8320FDB43846E306BAFFCDC54650E577F46FDF560959B414550E13EBE1247,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157973Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:55.229{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157972Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:55.229{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157971Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:55.229{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157970Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:55.229{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157969Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:55.229{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157968Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:55.229{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157967Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:55.229{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157966Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:55.229{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x800000000000000099270Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:55.014{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A4C6A3D63FF3639920BF9FFFCC58FCC1,SHA256=42F0E9C07FDC01E34D01C70CFD06FBFC11E0170E0B565E7D01464C5E2CAFA752,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157975Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:56.715{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8E47BE38BD244CAFA82CE39782E29BFB,SHA256=E2894A1CB44D9676C1DF58AC30560E8D1F9C27B4144CD242A10DA08A6DCCB718,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099272Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:56.358{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B0C5509CBFFE99622E7AC8C4C01404FF,SHA256=20124D5196BF7103C0B3E2578727B6E40977FA27D6B25C164E1F07DFB1332B96,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000157984Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.727{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E70F9721112EF548638DEEB7DACE5C60,SHA256=F68500506E571B444472847C462F24F754303A20D0E18C518885BD152D439233,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099273Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:57.373{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4FB5437F798C03A7486A225A63F1530C,SHA256=33EE13FE9D1F3859B16A9040341999513915375B3841B88C198F64F279621363,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157983Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.246{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157982Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.246{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157981Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.246{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157980Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.246{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157979Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.246{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157978Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.246{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157977Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.246{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157976Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.246{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000157985Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:58.730{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F697B376B69A6CBFCFAB11C37D10B6DE,SHA256=CC0E178661BCCF65467C12ABC390324D8BA65427321DB2DE0D5780F59851FAA3,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099274Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:58.373{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CABBCD63ACB251EAA61C681B4CAA849C,SHA256=2CE7B9F7D13D847220EA7F2DECD632E22AAF1A8F90DBCCAD4880530F5FCDED1F,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000157995Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:57.478{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58047-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157994Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:59.730{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=56B1A4B4E3D8E2904636657C99A2BF4F,SHA256=D0ECC1BB2E6E1781C8F78B3F98FDAACE34B2D3B85CE84B19732317C04A06E509,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099276Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:59.373{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0E68BADD8502EBA2C0024F36768DD0E1,SHA256=60D0F8FDE99D78C125CC40EA47B3AA4B49DC4F277A8C078BB15D81E7655DD893,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000157993Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:59.261{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157992Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:59.261{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157991Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:59.261{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157990Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:59.261{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000157989Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:59.261{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157988Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:59.261{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157987Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:59.261{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157986Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:55:59.261{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 354300x800000000000000099275Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:55:56.471{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50211-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000157996Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:00.730{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=88673A1A5E299A14DB40918452D64611,SHA256=E057DDBB2A320A45C6B797B6584DB81A3633F00C4B84BD0A8ED6BE6C420CEA75,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099277Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:00.591{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=5FB4D051D4E6F91566C70379EE53A75D,SHA256=1B95969532F4E0A1E4BF347BEC54264C998B038A1871683E30C4636D889D1952,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158005Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:01.746{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C866C003E0130ACC629BC487CF94B78,SHA256=B27100DA1CA1163BCE2923F2A18BC4478B8DF6E439825B676982E7036AFCC756,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099278Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:01.716{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0235093255D0B1AD00164CDF5C68E926,SHA256=DEA20637B93AFEEE326BB511C8AC1378A4DFDDE6F15142380B20A428F9D8062A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158004Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:01.277{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158003Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:01.277{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158002Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:01.277{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158001Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:01.277{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158000Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:01.277{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157999Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:01.277{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157998Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:01.277{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000157997Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:01.277{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158006Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:02.746{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A06EC8DD2B9D4AFDD193FE446FAF295A,SHA256=DF2D6C409D91B965DA67E28AB4E4B8D3A5E60BB07FC497A648EB3B1EEB09B17B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099279Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:02.747{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FA1BBDBB9D01ED2D39C5227FD42AD566,SHA256=D1ADFD0B4A89752184E00BE025D559330828086B977FDCC4DB43019CC59AF26A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158016Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.965{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=534DCBD23EADBC57A545694E1B3D263D,SHA256=014EA95528E08B109B34A998684C70458C5FFA230A265DAED9A1816B09472236,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099281Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:03.872{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F532F1A37588181AC9B796B0679ED47D,SHA256=48078D78801097DD9455C63119AE03DF48109BFDF305F733C57D6174D0D81D6F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158015Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.294{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158014Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.294{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158013Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.294{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158012Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.294{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158011Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.294{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158010Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.294{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158009Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.294{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158008Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.294{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158007Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:03.215{27B03E6B-D3AA-60B9-1100-00000000C501}380NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=18716E3AC4E258C312A04614871D552F,SHA256=C90E699AD09E755504F84DCFA6E590D34803961841629BF61DA3349AF56A61BE,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099280Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:01.579{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50212-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000158028Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:04.965{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3993A3741C7898200481D8396141BCAA,SHA256=12401D1A6FDA5B3FA2F59DC225CD59DA23BCF9F479E6A4C57DA615E555E3CB1A,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000158027Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:02.606{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58048-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 13241300x8000000000000000158026Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x8000000000000000158025Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0022eb54) 13241300x8000000000000000158024Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7590e-0xaf6d24f7) 13241300x8000000000000000158023Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d75917-0x11318cf7) 13241300x8000000000000000158022Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7591f-0x72f5f4f7) 13241300x8000000000000000158021Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeConfidenceDWORD (0x00000006) 13241300x8000000000000000158020Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\SecureTimeTickCountQWORD (0x00000000-0x0022eb54) 13241300x8000000000000000158019Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeLowQWORD (0x01d7590e-0xaf6d24f7) 13241300x8000000000000000158018Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeEstimatedQWORD (0x01d75917-0x11318cf7) 13241300x8000000000000000158017Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:04.371{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d7591f-0x72f5f4f7) 23542300x8000000000000000158037Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.965{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0F62BF6901F0D25253C46EF76ADD52D3,SHA256=2FD229369457DA18259A734CBC2ABBB380373966963DC37D9203C5EB4078AF04,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158036Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.308{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158035Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.308{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158034Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.308{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158033Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.308{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158032Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.308{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158031Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.308{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158030Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.308{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158029Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.308{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x800000000000000099282Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:05.028{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A0299503F7B686DEA155CACFDF68E5C1,SHA256=0CC8F0E71358120BE0BEF70F39EA17AC20EF573360D247A5C0346B52F204F71B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158038Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:06.199{27B03E6B-D3BA-60B9-2A00-00000000C501}2856NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099283Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:06.153{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B092EA2DCDA9E90B19E12C7FB0D68201,SHA256=3D1D12AD8DD33983C9841EFFC38DFC1E93D368C14925C1CCDE6170850158C6D9,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099284Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:07.309{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CC29D9556B833580779E74F694B7009F,SHA256=343C439BE7AC5C21B0BDF9EC5CB62CA40F669C9BF06AED60CB931637451F5265,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158047Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:07.324{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158046Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:07.324{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158045Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:07.324{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158044Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:07.324{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158043Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:07.324{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158042Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:07.324{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158041Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:07.324{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158040Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:07.324{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158039Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:07.027{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E6C9F8A7805EEDCF25A943431803BAD7,SHA256=1263BE9AE91CBE0F23C452D5525981EE46F4E3EA54F9A77247ADB44B81898204,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099285Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:08.449{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9F6C65BAC68B5CB1B3322D88C930716C,SHA256=AD75DE23793E0E0E151A0F2C299CEA23AE3FCC29ADD5004F5E0847372199EF37,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158049Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:08.027{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=49BCA13E50FB9F9DA91AEA5BBC6B0422,SHA256=362AC0223A83ADB393BDD922822EF79AF7A3CD9F0690BB10A3BB18F7250AAEB6,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000158048Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:05.575{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58049-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000099286Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:09.449{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1F5593CD1684E66AEE983E012B208F79,SHA256=1D24C5AB59BEDB58D945E6EB6AC30708BBA054C68B5DE6120C4E38F5F7E68CF0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158058Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:09.340{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158057Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:09.340{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158056Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:09.340{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158055Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:09.340{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158054Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:09.340{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158053Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:09.340{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158052Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:09.340{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158051Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:09.340{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158050Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:09.043{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0839224D47C081095E49439C6D2D6C42,SHA256=DE2EE6053CF75E73364D95C018AB98345EDB4A8A0B6969CBFF4E70998FA566D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158059Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:10.059{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F870D249D3E2B399B63CFFE066ECDD7D,SHA256=644456F5D32964ABB18C56A801C6D4BBE183D59CA804E418DFE9290ACE4A5257,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099288Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:10.449{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=42ACAD1673AAF15FE3B8A154CD933556,SHA256=B06A0443473FE541F2B4EE3DE6010472E7414EEE99D220B18F45445C76EA6F13,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099287Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:07.423{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50213-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000158069Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:11.356{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158068Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:11.356{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158067Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:11.356{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158066Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:11.356{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158065Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:11.356{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158064Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:11.356{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158063Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:11.356{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158062Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:11.356{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 354300x8000000000000000158061Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:08.512{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58050-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000158060Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:11.074{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8294424364E202904A238ABBEC9B0AFE,SHA256=F67ACA0DA96305817D4DBC9C946A59E80B2FC0445DB7778B9B5E4991ED290D50,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099289Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:11.464{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2A36E5AE755D7096882E3ED540A8E869,SHA256=7C816DEAA50A0C90E0B16125BE14014771A5DB3A6D523F551129A78DECC4ABBA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099290Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:12.464{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=320021876AC0B10638A9052DBFEE32CF,SHA256=B201F41F02FDC0EA78920C51A795D6D7F5C6D63D2D68FE4AEF5091A413A62B2D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158070Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:12.199{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B91099EE12A505F78B7E7B425DCE28B4,SHA256=D45F92D69CF6BBBB815D4CF1233278FB6EF6CEA9A2E3906719A4324A9ACE610E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099291Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:13.465{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=545CE518925AEA903A06136C7DE675C8,SHA256=520AF970E4520898259702F958E2580C732B72C81A50C1369B364A373CA0E237,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158079Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:13.371{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158078Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:13.371{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158077Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:13.371{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158076Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:13.371{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158075Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:13.371{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158074Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:13.371{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158073Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:13.371{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158072Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:13.371{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158071Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:13.199{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4DC84A5DB01E26E8735987792B5B470C,SHA256=E93C05EE589E814553410E5B9BC66D2730F5C1AAC1A340B8E5A6BE63F650CF9C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158080Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:14.231{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9C38DCA241AB539D4F520C5844E801AE,SHA256=3A2993ED59EB28C9DE8E353430C85536FFD5AF662A34413D9A1B4E5B032C1D4C,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099292Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:14.466{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E362F1F11BF0A1D7F7C5CC2E8D7B8DFE,SHA256=D7ED4CB1B15ADF43F2188FCF0D707E1A39506EE9E4A2C52130BDD4BCD910E260,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158089Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:15.450{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7BC05A1762D711C997EC8BB28DF2857E,SHA256=6BD1668710DD0B7CE5B6782242F1760BF1A91DBEC18D42B98904F9E6D9CC1E44,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099294Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:15.468{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=EC0C399022CAD62658CE501E7DD716EA,SHA256=21315DE5A1A26B0D0E0E07FFF574BEF6F6D49D55B12336491C25FF12E4B033CB,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158088Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:15.387{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158087Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:15.387{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158086Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:15.387{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158085Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:15.387{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158084Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:15.387{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158083Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:15.387{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158082Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:15.387{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158081Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:15.387{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 354300x800000000000000099293Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:12.438{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50214-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000158091Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:16.450{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=596437AC1A623EF0B0E2BCC0843AF29A,SHA256=96AF2BE2E70B6C434F5BAFE481D575F8D2292D9A25E1808F1422FEE7A3D5258D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099295Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:16.468{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7C4B92E801018AA6C2F70F79BCFD5977,SHA256=559A5E2232B224EE127430A1F2A1422FCBE4E438D0B9335D3B1B4E47576C56C0,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000158090Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:14.465{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58051-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000158100Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:17.481{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7ECB6F6B672DF864F879ACFB9F949213,SHA256=0DE05D4FCBD3B4115CE6324F7B9B191AC52529DDDA624505C94135051A40A35B,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099296Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:17.483{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D1E186F45A9251BE51369DEABA5DB1F1,SHA256=E1A8919DD0F2CEA8F7DA4D6B8C386A32C83F35C8F1F215E4403FEF72BB481059,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158099Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:17.403{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158098Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:17.403{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158097Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:17.403{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158096Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:17.403{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158095Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:17.403{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158094Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:17.403{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158093Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:17.403{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158092Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:17.403{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158101Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:18.481{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B8F80AAC76B4E0976B9B9E9F53AD3167,SHA256=DA56B716173CC3C5B82DFFBB60589A92790BE0BB08413A50160112815B308C13,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099297Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:18.483{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=21DBEF7DD37208AF7F24835909DBB8FC,SHA256=99D6119733D53BCEC5BE2E19CBF93AD216F5F95891F83A20E45F8F1E79C98EF5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158110Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.481{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=58D7849F861AA182661AD62B6EAD4833,SHA256=C0A7DF3362749BC568D5A514F2401FC551C43C87C8D8736DD6F2B9C5155F63AC,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099298Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:19.483{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A9B538C63EBDA9941475BDC9B2792AA6,SHA256=C32749D044B97A3DD9F30B10264EC9C26D9E96742EFBDC4F042CCAC20AB08F81,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158109Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.419{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158108Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.419{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158107Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.419{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158106Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.419{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158105Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.419{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158104Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.419{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158103Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.419{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158102Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.419{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158111Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:20.481{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=534B8FCF3018B237D26EC2F043FA75E3,SHA256=4B8704983F1B4468FB219BE01DB3B22D077E61A810AFA111DEEC8D5E45BF9A98,IMPHASH=00000000000000000000000000000000falsetrue 13241300x800000000000000099301Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-SetValue2021-06-04 07:56:20.686{38D812B3-D3CA-60B9-1100-00000000C601}996C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d75917-0x1b3dae15) 23542300x800000000000000099300Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:20.498{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=711DE859B669C10FB0CF2356690ECEB9,SHA256=018D9C841771F3BF793F549A75DCB4369264829ECF6CB047F9D86EAF793C2FDF,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099299Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:17.537{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50215-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000158120Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:21.481{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ADBAF9F5F3D60AFB270F3AB3BD747640,SHA256=ADB84C909E267D35E7AEB461812E25CB17B190038A8365792A2EC81F1857D7B2,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099302Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:21.498{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=713B6FD9C17E917853817CF4BD5D3D6C,SHA256=CC559C41C6ECA6708D0DFEABA5AA9FDA0F129125C4E7F51CF1195720E5881A58,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158119Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:21.434{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158118Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:21.434{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158117Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:21.434{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158116Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:21.434{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158115Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:21.434{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158114Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:21.434{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158113Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:21.434{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158112Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:21.434{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158122Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:22.481{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E4F1BAC966988CA8FCC7A1418A140DE3,SHA256=93CE1961B375B770AFFC76DF50D25C55B5AAC9ECD9DDA99DD95181E2CE15F064,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000158121Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:19.637{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58052-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099304Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:22.514{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2041E6C5962C695B1C92B67CE4CB316D,SHA256=FE371FEB53130D3F215E77049B17B465F1CE8760D8D19655F4DDB9E822032F86,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099303Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:22.155{38D812B3-D3CB-60B9-1C00-00000000C601}1936NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeC:\Program Files\SplunkUniversalForwarder\var\run\serverclass.xmlMD5=01D39602C16211133E15AF299CF00EAB,SHA256=AAA6545EE2F19F971D1FFE8869E877970BE879AC50F8E061308F3E3C1C930E8F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099306Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:23.717{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=F6DECBDC15C69492318C51BE52670920,SHA256=0956C548862E052A5B33224D8D79C9A6F8042F130414F33A47576E0C264B6AA8,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158131Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:23.637{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=19A1949DE7160D115FF98F301D925620,SHA256=A5064A8F7A7BE06E473E3E14351DC30FE7EA93B136D4514DAC5BE0886D7D4DCD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158130Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:23.450{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158129Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:23.450{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158128Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:23.450{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158127Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:23.450{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158126Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:23.450{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158125Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:23.450{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158124Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:23.450{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158123Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:23.450{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 354300x800000000000000099305Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:21.490{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50216-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8089- 23542300x800000000000000099307Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:24.951{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2E5E46B8AE4896D42FCC47F205FDEF8B,SHA256=03A1592640ECAF2F8F0777EF192BAE6FAA85B28D6A0727E77518CC0FB7335D17,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158132Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:24.638{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C81263DBAC6A9DB0169140AB24D0B700,SHA256=C51560806C23F4C8A366DDBE3423423CB3289266BE6B7F7626356C39400B7F79,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158141Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.856{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DEBB9EB793C593FA41EA8DE43FF885D3,SHA256=C5379F778DE36E6A4E72784CF9B06D22900830E0C5C5667A168DF828ADA3CA18,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099308Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:22.599{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50217-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000158140Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.466{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158139Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.466{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158138Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.466{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158137Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.466{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158136Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.466{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158135Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.466{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158134Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.466{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158133Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.466{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158143Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:26.856{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=7470DC14F9EFFCDECC627AA6F1B0A428,SHA256=75E8FA265D0D816AF04158F3CC33DAAE641B6BAA33333E45C586C39A69094F9E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099309Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:26.185{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=184C602FF81D1EF99BDE268D6C80723B,SHA256=CE46C65EB0E014FF0B139FD7218FB819DB2086D35C522DECEE3E01392CC4CD9D,IMPHASH=00000000000000000000000000000000falsetrue 13241300x8000000000000000158142Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-SetValue2021-06-04 07:56:26.513{27B03E6B-D3AA-60B9-1000-00000000C501}96C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTimeQWORD (0x01d75917-0x1eb6c1aa) 23542300x8000000000000000158153Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:27.872{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=FDA8B7EFEB1F67839C2DFFCCB4174B31,SHA256=2B6EAA5B88061E02A4647E756B6B373DB8392E09DE8888E23DED6F9C719BCB4A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099310Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:27.388{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=20B9AE3C15112397BBD7E7CED86D34AB,SHA256=68D79B16FC6EFDD87D82212948A8028C874338BA4236177B649A1CB697E11BAD,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158152Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:27.481{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158151Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:27.481{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158150Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:27.481{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158149Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:27.481{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158148Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:27.481{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158147Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:27.481{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158146Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:27.481{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158145Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:27.481{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 354300x8000000000000000158144Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:25.528{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58053-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000158154Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:28.872{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B212F276064743EFD6834AE314308642,SHA256=4DD050982526C00682EFD1FD8494BB1C7DC8AD7989938B215076B5C18FF4F9D6,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099311Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:28.529{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=53EFF044556058609DDECC6A0DBC76EC,SHA256=FBF16FAA750033D9386F3A62A4167F375702A45F85C6742C0275D90FC11DC940,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158163Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:29.872{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AB1A031A1735AD3315228C357FE1A335,SHA256=A9CA871DDA3D7213544E6A374AD6720D057DAC50AE6B486C74BAB70412811A8D,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099312Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:29.544{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4D241A62EC391A4A917EF52ADB9D7857,SHA256=83811A05E320A61FB93EDB281EE7B6DC95AACC307465ED44BA93DEF70559E8B8,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158162Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:29.497{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158161Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:29.497{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158160Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:29.497{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158159Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:29.497{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158158Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:29.497{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158157Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:29.497{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158156Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:29.497{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158155Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:29.497{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158164Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:30.935{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=8D5ECCF489F07C6BF4A425055FE96EF4,SHA256=1C3E787B6DE2FDC02C9C4770B7C87910B3E7BD20BA0066FE826278B47EDEBB38,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099314Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:28.505{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50218-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099313Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:30.544{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A799CB984E74AE03A2593940F5BE89BA,SHA256=8AFAD2B49F82571E8608D475677548BD28B6AE1B41B5226D7D99EB0FF29DFEE0,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158181Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.966{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=4356C38B1BE440C5131210855DF486D0,SHA256=D7B0B53D52B86713B3DC82528BFEB92890BEA4306CF6341912D3EEE5113048E5,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099315Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:31.544{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=DDFFFB7143FD489D53FFE4B52A528242,SHA256=EFEE9D832CB4C14D994A8B2BEDBA1868EB10595B38B73930B8FDEA92ED9E9F3A,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158180Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.700{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DCAF-60B9-C601-00000000C501}2492C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158179Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.700{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158178Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.700{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158177Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.700{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158176Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.700{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158175Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.700{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DCAF-60B9-C601-00000000C501}2492C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000158174Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.700{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DCAF-60B9-C601-00000000C501}2492C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000158173Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.701{27B03E6B-DCAF-60B9-C601-00000000C501}2492C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 10341000x8000000000000000158172Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.513{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158171Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.513{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158170Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.513{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158169Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.513{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158168Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.513{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158167Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.513{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158166Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.513{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158165Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.513{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x800000000000000099316Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:32.560{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=CF4541FB40F73D1B21593258A73A10BA,SHA256=816B28DCA82930B7B86E417288C58D9E526B1695DB08796DE2FA06CD7D46E4D7,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158191Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.857{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D846007F7023D29F32A1CA0DF70876E0,SHA256=BC322B179D85ADFD9FD35705E25A3B6A9CCEC8AF51B54F4616A9E743DB21DFCA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158190Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.857{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=A9B05B7B53E94B0074088761327CD603,SHA256=66842F6069675F410839568D7956722DBD959C5BC013FFED8F972F8C60ABFB29,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158189Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.810{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DCB0-60B9-C701-00000000C501}4216C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158188Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.810{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158187Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.810{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158186Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.810{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158185Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.810{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158184Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.810{27B03E6B-D3A7-60B9-0500-00000000C501}4202108C:\Windows\system32\csrss.exe{27B03E6B-DCB0-60B9-C701-00000000C501}4216C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000158183Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.810{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DCB0-60B9-C701-00000000C501}4216C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000158182Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.811{27B03E6B-DCB0-60B9-C701-00000000C501}4216C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099317Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:33.574{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=B6A9635DC185E2AEB76C34CAC8A18654,SHA256=B3F2EC818C4842653F4BA104B7DCF3AEB800FBFF934F9E5FC9CFCBA3CE9FE1A3,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000158210Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.419{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58054-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000158209Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.575{27B03E6B-DCB1-60B9-C801-00000000C501}7082728C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158208Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.529{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158207Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.529{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158206Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.529{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158205Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.529{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158204Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.529{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158203Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.529{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158202Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.529{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158201Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.529{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158200Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.372{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DCB1-60B9-C801-00000000C501}708C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158199Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.372{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158198Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.372{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158197Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.372{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158196Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.372{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158195Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.372{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DCB1-60B9-C801-00000000C501}708C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000158194Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.372{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DCB1-60B9-C801-00000000C501}708C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000158193Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.374{27B03E6B-DCB1-60B9-C801-00000000C501}708C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000158192Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:32.997{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3F5AD36529E1A81CCB863E5702305DAF,SHA256=1C8C63E49AFAB015D374915D4F11B46FBFE70C96AE7AB2FC17B404CEED7F7347,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099318Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:34.590{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=29C713D569CA4CFB7C4AAC5984791D34,SHA256=6A839371156A682E2CCFB5FED586D4A972149427168DD0BB2FDA6F67C87FBDA4,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000158214Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.856{27B03E6B-D3A7-60B9-0B00-00000000C501}640C:\Windows\System32\lsass.exeNT AUTHORITY\SYSTEMtcpfalsetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58055-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 354300x8000000000000000158213Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:31.856{27B03E6B-D3BA-60B9-2600-00000000C501}2784C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exeNT AUTHORITY\SYSTEMtcptruetrue0:0:0:0:0:0:0:1win-dc-819.attackrange.local58055-true0:0:0:0:0:0:0:1win-dc-819.attackrange.local389ldap 23542300x8000000000000000158212Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:34.372{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=D846007F7023D29F32A1CA0DF70876E0,SHA256=BC322B179D85ADFD9FD35705E25A3B6A9CCEC8AF51B54F4616A9E743DB21DFCA,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158211Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:33.997{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6025EE58AF88DBB8BAA0C8FE963917B5,SHA256=AEF1F92D4FE641FABAE2AE66DAFFBC8269799EBD4CE32C15508DF5D9896729DF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099320Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:35.605{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=C4B585D6C4309C183CB7A16BC94586D1,SHA256=56A34097B34B593C61574DBE510E5023742526A2B8FFDDC43BA858AFDEFDFB3F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158232Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.544{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158231Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.544{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158230Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.544{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158229Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.544{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158228Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.544{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158227Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.544{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158226Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.544{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158225Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.544{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158224Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.482{27B03E6B-DCB3-60B9-C901-00000000C501}52885996C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+5691a5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+568cd6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56657|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+56ca7|C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe+8f3800|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158223Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.326{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DCB3-60B9-C901-00000000C501}5288C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158222Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.326{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158221Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.326{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158220Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.326{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158219Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.326{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158218Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.326{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DCB3-60B9-C901-00000000C501}5288C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000158217Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.326{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DCB3-60B9-C901-00000000C501}5288C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000158216Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.326{27B03E6B-DCB3-60B9-C901-00000000C501}5288C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe8.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000158215Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.029{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=062A74F86168260ECECDBCA26A77BB8D,SHA256=C7B39E9BBA4FDA89115F491A5C782060B6136AC67C1CEFC2CEE9C75924174EF4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099319Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:35.590{38D812B3-D3CA-60B9-1300-00000000C601}96NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exeC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.datMD5=0ABC0F57DA759369DE2D8EBA00BEB45C,SHA256=9820BDAA5D097C9BEB28ED02C99CB78C75BEBD4F9406F5C19B49BA4F4269D574,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099321Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:36.605{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=72E6437DEC7E270769DE3A53DB520EAE,SHA256=66EBF3651C268ECD960102A9415E22472A52AA69CC4E48A4DF01D01461153AA0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158252Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.873{27B03E6B-DCB4-60B9-CB01-00000000C501}57165324C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158251Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.669{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DCB4-60B9-CB01-00000000C501}5716C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158250Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.669{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158249Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.669{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158248Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.669{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158247Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.669{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158246Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.669{27B03E6B-D3A7-60B9-0500-00000000C501}420436C:\Windows\system32\csrss.exe{27B03E6B-DCB4-60B9-CB01-00000000C501}5716C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000158245Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.669{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DCB4-60B9-CB01-00000000C501}5716C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000158244Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.670{27B03E6B-DCB4-60B9-CB01-00000000C501}5716C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000158243Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.404{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=08794D972A018E5137825AC564BBC35F,SHA256=9E4FB1E93F6F0062F03D443E47103FD5AB70DA3757E9633E52F50B9E21EF3F2A,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158242Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.279{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=59F3470F486D9A457B06AEF4E9CCD688,SHA256=552DBE44B5947F0664EA37C667F6FD944195A7F631BA3914A6B83AE17C787D2B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158241Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.169{27B03E6B-DCB3-60B9-CA01-00000000C501}51841016C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158240Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.998{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DCB3-60B9-CA01-00000000C501}5184C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158239Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.998{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158238Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.998{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158237Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.998{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158236Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.998{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158235Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.998{27B03E6B-D3A7-60B9-0500-00000000C501}4202108C:\Windows\system32\csrss.exe{27B03E6B-DCB3-60B9-CA01-00000000C501}5184C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000158234Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.998{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DCB3-60B9-CA01-00000000C501}5184C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000158233Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:35.998{27B03E6B-DCB3-60B9-CA01-00000000C501}5184C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099323Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:37.621{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BF928030D797531AF942AFB125718608,SHA256=C31F80E946F1829675B73A199F78A1B26209D7FD2B4661AB0E7C3A5CBC0932D1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158262Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.748{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=545F1DE79F8EA46853659BD717E6A90D,SHA256=0352F0FC6CF8210EC13D2EA62ABF49EA49FD19171E155DCC82C9ABA7C34F8F58,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158261Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.560{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158260Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.560{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158259Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.560{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158258Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.560{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158257Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.560{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158256Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.560{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158255Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.560{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158254Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.560{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158253Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:37.216{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=3B58F5ACEB9020106993EC6AAC9AD7DE,SHA256=7008D2F4DCC3D60094DD8AF8A4EBC130C9ED032132B678BB01CFF67B522A72A4,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099322Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:34.427{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50219-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099324Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:38.621{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=554AF6B992351167B317CD24B7A6C53C,SHA256=F9F79C0F132828F71B00A6E2948C5D5163856DA40D843DB69FE0FB0D25FA993F,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158271Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:38.420{27B03E6B-D3BB-60B9-3300-00000000C501}32203240C:\Windows\system32\conhost.exe{27B03E6B-DCB6-60B9-CC01-00000000C501}1552C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158270Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:38.420{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+fd18|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158269Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:38.420{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158268Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:38.420{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158267Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:38.420{27B03E6B-D3A9-60B9-0C00-00000000C501}8365072C:\Windows\system32\svchost.exe{27B03E6B-D3BA-60B9-2700-00000000C501}2792C:\Windows\Sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x8000000000000000158266Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:38.420{27B03E6B-D3A7-60B9-0500-00000000C501}420540C:\Windows\system32\csrss.exe{27B03E6B-DCB6-60B9-CC01-00000000C501}1552C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x8000000000000000158265Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:38.420{27B03E6B-D3BA-60B9-2A00-00000000C501}28563900C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{27B03E6B-DCB6-60B9-CC01-00000000C501}1552C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x8000000000000000158264Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:38.421{27B03E6B-DCB6-60B9-CC01-00000000C501}1552C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe8.0.2Windows Print Monitor splunk ApplicationSplunk Inc.splunk-winprintmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{27B03E6B-D3A7-60B9-E703-000000000000}0x3e70SystemMD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748{27B03E6B-D3BA-60B9-2A00-00000000C501}2856C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x8000000000000000158263Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:38.216{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=61FDFE13A60799E656DE37894ED6994B,SHA256=FDECB7592BE4038A12D19A6275794B6D7693FA4A975D8F4B69FB53406BD4D0BE,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099325Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:39.620{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=AEB211B210C4A4D1FA7D864275BA405D,SHA256=F8B2832C781C8CE2643499B06C45C4EFC12DB5EE6FB3DA1D5A3C127289A67650,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158282Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.576{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158281Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.576{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158280Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.576{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158279Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.576{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158278Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.576{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158277Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.576{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158276Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.576{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158275Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.576{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158274Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.545{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=88410671DAF30F16D5B8E25B3EF95DB0,SHA256=CAD9A7EF371ABA74AB0D9D90BCB5437C09E2149087828E54DA4CF8D678F5E00D,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000158273Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:36.637{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58056-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000158272Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:39.216{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=2EE6D05394FC53F017A18095C016150A,SHA256=B78B64560821C2E4E009BC14AA9084CB664150224D231D31DC681DD7B148A553,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099326Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:40.620{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=D702B624A6C2C6B18A46ED7E1A2DBE6C,SHA256=8ACA70303767D1317F2385B1B4660DC6B47B0BE0169D458F5DA83EC8012BB450,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158283Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:40.216{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=6E478C0D299B5B4893923541E2F131DB,SHA256=B3E7287C8B32E05516DECBF68EA8921AB8BF126327D882C681E930EBD3228E5E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099327Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:41.620{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=BC9558989EA2CA53FFC9C22C23FE1D3C,SHA256=DD2B342555AF37C47CE5A072211D9334C15B2DF847A8AC4AA615EA51C3D674F0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158292Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:41.592{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158291Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:41.592{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158290Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:41.592{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158289Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:41.592{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158288Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:41.592{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158287Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:41.592{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158286Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:41.592{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158285Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:41.592{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158284Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:41.232{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=68D3CBE68887541AE4C1AE76CA61684D,SHA256=91602A68C8507510EE914A87E80C6A1A1561D7C2199DDA8E79351FD393208F1F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099328Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:42.620{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=15C9A077E2784FC8AF099BFCEBF0DD21,SHA256=F0AE65AE8FAC5036E3363AC192B4677B0138FBCE430D6F2FB7449B8219327C2F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158293Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:42.279{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=27604BCF6B6E37C0D0004EC493CBFCA5,SHA256=FD4B182E5C09AC05BBE9F1558D17562CDA65B29137900EE70C71D0AC2AD312A1,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099330Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:43.636{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07ADC8E1512D0DCC3303613E272CF8ED,SHA256=2C53C4885E6A0A5A3BEFE13B651F6CED4BC2218943AE7E68226FB618933EAB4D,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158302Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:43.607{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158301Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:43.607{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158300Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:43.607{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158299Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:43.607{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158298Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:43.607{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158297Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:43.607{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158296Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:43.607{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158295Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:43.607{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158294Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:43.295{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=939FDD365EBFE7C4BEB4C088C90CB7A9,SHA256=AD75BAB746E2647D00514EBEAEDAE398940F0FD5A54DB755C4F25503910BF807,IMPHASH=00000000000000000000000000000000falsetrue 354300x800000000000000099329Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:40.427{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50220-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x800000000000000099331Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:44.651{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=ED0E6E5571DD08455C4EEEB8E1008182,SHA256=F8DBCF62719CB919755F24BEC9BC038E18909290CD7F8318DF6DD903A10267CD,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158303Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:44.529{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=0055234342872732E836992F237C4930,SHA256=427A25502F69C6B7DF78F9A6C7C2DDAE1CA2318FF939FF382231230A454859D4,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099332Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:45.651{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=65DEB64DC2AE53E6637881BE70F1CCA1,SHA256=9BA6650761850540392F417F3A67EC45FD9E3BDE0021B556E1E8BB1295F9F515,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000158313Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:42.513{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58057-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x8000000000000000158312Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:45.623{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158311Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:45.623{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158310Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:45.623{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158309Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:45.623{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158308Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:45.623{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158307Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:45.623{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158306Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:45.623{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158305Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:45.623{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158304Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:45.561{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A2A2599E7DAA916E3B6368544F5F5830,SHA256=DC6FA3B38D749CF3285083A3D11CB773407B6F954D32F4381CFA27606659235F,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099333Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:46.651{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=175C7D9738B942E10B97069C6A9FAF1D,SHA256=BBF4E7DD6B91F0A9CCFDE18ABCB10FD5A12482334503EC0CA6E698C96AD82B0E,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158314Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:46.576{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=9D96F1D9A2C7078F757E79DEB0A6CE37,SHA256=C9FA1A99F0172A4A8270AD9BC7EEC14413B40082D6E9A3EBCD0C9CE90A39D501,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099347Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.651{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=07827354355684ED400447C4C9ADBF22,SHA256=56DAAE7D19524E02CCE56E9DD88B1EC789A7F4F558591EE4C91C42CD4D82C6C0,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158323Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:47.639{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158322Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:47.639{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158321Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:47.639{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158320Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:47.639{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158319Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:47.639{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158318Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:47.639{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158317Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:47.639{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158316Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:47.639{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158315Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:47.576{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=A8FFB197B6C0DE449F9DE7371C35F319,SHA256=45A1A3821D76DD88A1F6C126302E50B1C8C013571163F2F6157766FE0BD76DFA,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099346Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DCBF-60B9-A001-00000000C601}2432C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099345Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099344Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099343Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099342Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099341Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099340Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099339Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099338Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099337Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099336Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3C9-60B9-0500-00000000C601}4081988C:\Windows\system32\csrss.exe{38D812B3-DCBF-60B9-A001-00000000C601}2432C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099335Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.401{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DCBF-60B9-A001-00000000C601}2432C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099334Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:47.402{38D812B3-DCBF-60B9-A001-00000000C601}2432C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 354300x800000000000000099378Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:45.536{38D812B3-D3D5-60B9-6400-00000000C601}3924C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.15win-host-926.attackrange.local50221-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 10341000x800000000000000099377Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DCC0-60B9-A201-00000000C601}3284C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099376Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099375Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099374Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099373Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099372Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099371Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099370Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099369Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099368Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099367Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DCC0-60B9-A201-00000000C601}3284C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099366Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.791{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DCC0-60B9-A201-00000000C601}3284C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099365Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.792{38D812B3-DCC0-60B9-A201-00000000C601}3284C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe8.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099364Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.666{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08BB5B3CCF085F5836D9195E86C246F7,SHA256=BCE522D4ECEAA84A6CC712C8561ED706F2319754D290DC6721AA43A9B2105C25,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158324Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:48.592{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=38522C9E8AF57113EABB0E22F944B10C,SHA256=A88AA7EF3F11332106ADA8A63D7540D9395654A8743AB078E24CC0E5E9999EDF,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099363Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.401{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7103158A22D9BD2F9FE0FF2020F08AEE,SHA256=97C3F24FB27CE53C3670FB78CC6B2D0BF516E12C337AAC6E9001D945A44C1E35,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099362Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.401{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=53DE84278D661FFEB77C1B9C491FE312,SHA256=DB3F41663AF1DA3FBCAC44FC1D3A65C3AAFF4A354F433A36E012E5F88A311880,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099361Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.245{38D812B3-DCC0-60B9-A101-00000000C601}2308956C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6025c5|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+6020f6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+59e67|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+5b88c|C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe+8e7d70|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099360Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DCC0-60B9-A101-00000000C601}2308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099359Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099358Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099357Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099356Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099355Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099354Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099353Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099352Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099351Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099350Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3C9-60B9-0500-00000000C601}408424C:\Windows\system32\csrss.exe{38D812B3-DCC0-60B9-A101-00000000C601}2308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099349Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.104{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DCC0-60B9-A101-00000000C601}2308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099348Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:48.105{38D812B3-DCC0-60B9-A101-00000000C601}2308C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe8.0.2Active Directory monitorsplunk ApplicationSplunk Inc.splunk-admon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099379Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:49.666{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1CB0132C761FC5D0F01541A6282CE51B,SHA256=911857F404F17922520E2EB19221401A899A3F798532C18F4D3FE3D91C13BF7B,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158333Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:49.654{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158332Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:49.654{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158331Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:49.654{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158330Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:49.654{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158329Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:49.654{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158328Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:49.654{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158327Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:49.654{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158326Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:49.654{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x8000000000000000158325Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:49.592{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E3874F1844864D5043056D7434F91590,SHA256=74D1ECFBDC420C4D830140725806DBC3DD6FA3F240557CC936BD5494840F64A5,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099394Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DCC2-60B9-A301-00000000C601}3552C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099393Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099392Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099391Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099390Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099389Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099388Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099387Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099386Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099385Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099384Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3C9-60B9-0500-00000000C601}408524C:\Windows\system32\csrss.exe{38D812B3-DCC2-60B9-A301-00000000C601}3552C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\system32\basesrv.DLL+2f47|C:\Windows\SYSTEM32\CSRSRV.dll+5645|C:\Windows\SYSTEM32\ntdll.dll+5178f 10341000x800000000000000099383Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-D3CB-60B9-1C00-00000000C601}19363644C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe{38D812B3-DCC2-60B9-A301-00000000C601}3552C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a7404|C:\Windows\System32\KERNELBASE.dll+2b860|C:\Windows\System32\KERNELBASE.dll+6b246|C:\Windows\System32\KERNEL32.DLL+1c213|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+ce6a3b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17cade|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18641d|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+17ef16|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c992c4|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+18689b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+189d3c|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c95f5f|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c99fad|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+184c5b|C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe+c7dd7e|C:\Windows\System32\ucrtbase.dll+1fb80|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 154100x800000000000000099382Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.901{38D812B3-DCC2-60B9-A301-00000000C601}3552C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{38D812B3-D3C9-60B9-E703-000000000000}0x3e70SystemMD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service 23542300x800000000000000099381Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.666{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=E14CC20311D926B496A900BC53362952,SHA256=0814379D66659D719917595200B4488B1D98551EA6512017124095C5A4FC4A89,IMPHASH=00000000000000000000000000000000falsetrue 23542300x8000000000000000158334Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:50.608{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=08A52ED8CC790834CF88039B7E89E306,SHA256=AD75736E5BD6C307ADC4063046C841CD0342385F64DF0E4C216C1822EB3DA700,IMPHASH=00000000000000000000000000000000falsetrue 23542300x800000000000000099380Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:50.026{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\SecurityMD5=7103158A22D9BD2F9FE0FF2020F08AEE,SHA256=97C3F24FB27CE53C3670FB78CC6B2D0BF516E12C337AAC6E9001D945A44C1E35,IMPHASH=00000000000000000000000000000000falsetrue 354300x8000000000000000158383Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:48.466{27B03E6B-D3C5-60B9-6800-00000000C501}4076C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exeNT AUTHORITY\SYSTEMtcptruefalse10.0.1.14win-dc-819.attackrange.local58058-false10.0.1.12ip-10-0-1-12.eu-central-1.compute.internal8000- 23542300x8000000000000000158382Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:51.701{27B03E6B-D3CD-60B9-7100-00000000C501}3620NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=1C07EFC1352691C18BE45A25A461915A,SHA256=62B0565CFA82A92E9EA22E9CFF89833839B4FDB06D06F4B74442C289DBE98814,IMPHASH=00000000000000000000000000000000falsetrue 10341000x8000000000000000158381Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:51.670{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158380Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:51.670{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158379Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:51.670{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158378Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:51.670{27B03E6B-DC4A-60B9-BD01-00000000C501}61202112C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+783d0|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+6de02(wow64)|C:\Temp\release\x32\x32dbg.dll+6ea6f(wow64)|C:\Temp\release\x32\x32dbg.dll+6c11b(wow64)|C:\Windows\System32\KERNEL32.DLL+162c4(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b69(wow64)|C:\Windows\SYSTEM32\ntdll.dll+61b34(wow64) 10341000x8000000000000000158377Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:51.670{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158376Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:51.670{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158375Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:51.670{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 10341000x8000000000000000158374Microsoft-Windows-Sysmon/Operationalwin-dc-819.attackrange.local-2021-06-04 07:56:51.670{27B03E6B-DC4A-60B9-BD01-00000000C501}61203164C:\Temp\release\x32\x32dbg.exe{27B03E6B-DC52-60B9-BE01-00000000C501}3988C:\Temp\conti.exe0x1410C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\wow64.dll+2e9e|C:\Windows\System32\wow64.dll+2d80|C:\Windows\System32\wow64.dll+2d08|C:\Windows\System32\wow64.dll+3c0a|C:\Windows\System32\wow64.dll+6e75|C:\Windows\System32\wow64cpu.dll+1d07|C:\Windows\System32\wow64.dll+1bf87|C:\Windows\System32\wow64.dll+cba0|C:\Windows\SYSTEM32\ntdll.dll+92e47|C:\Windows\SYSTEM32\ntdll.dll+78135|C:\Windows\SYSTEM32\ntdll.dll+77f9e|C:\Windows\SYSTEM32\ntdll.dll+6ecec(wow64)|C:\Windows\System32\KERNELBASE.dll+deaeb(wow64)|C:\Temp\release\x32\x32dbg.dll+97309(wow64)|C:\Temp\release\x32\x32dbg.dll+b3818(wow64)|C:\Temp\release\x32\x32bridge.dll+6c30(wow64)|C:\Temp\release\x32\x32gui.dll+1150d5(wow64) 23542300x800000000000000099410Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.807{38D812B3-D3DC-60B9-7000-00000000C601}3424NT AUTHORITY\SYSTEMC:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exeC:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\WinEventLog\Microsoft-Windows-Sysmon_OperationalMD5=063FFDEBCC244F67337CB5EF45E8804F,SHA256=A4C2F5F8075E6E7673928E5E6007068D9FDED1DA5F7CF1B36538EF1E80780B79,IMPHASH=00000000000000000000000000000000falsetrue 10341000x800000000000000099409Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.713{38D812B3-DCC3-60B9-A401-00000000C601}27403948C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe{38D812B3-D3CB-60B9-1C00-00000000C601}1936C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe0x101400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e675|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+55e1a6|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+6b453|C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe+8e8530|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099408Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.572{38D812B3-D3CB-60B9-2B00-00000000C601}28962916C:\Windows\system32\conhost.exe{38D812B3-DCC3-60B9-A401-00000000C601}2740C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe0x1fffffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\SYSTEM32\ConhostV2.dll+5ca7|C:\Windows\SYSTEM32\ConhostV2.dll+774b|C:\Windows\SYSTEM32\ConhostV2.dll+a8ef|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099407Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.572{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+d3ae|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099406Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.572{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099405Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.572{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099404Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.572{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+12023|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099403Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.572{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8fc1|c:\windows\system32\lsm.dll+8eb0|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099402Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.572{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+e9d6|c:\windows\system32\lsm.dll+8e6f|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099401Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.572{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11aad|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|C:\Windows\SYSTEM32\ntdll.dll+1ecb9|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51781 10341000x800000000000000099400Microsoft-Windows-Sysmon/Operationalwin-host-926.attackrange.local-2021-06-04 07:56:51.572{38D812B3-D3CA-60B9-0C00-00000000C601}7203744C:\Windows\system32\svchost.exe{38D812B3-D3CB-60B9-1A00-00000000C601}1856C:\Windows\sysmon64.exe0x1400C:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+5eab4|c:\windows\system32\lsm.dll+11058|C:\Windows\System32\RPCRT4.dll+7a593|C:\Windows\System32\RPCRT4.dll+d9f41|C:\Windows\System32\RPCRT4.dll+62d4c|C:\Windows\System32\RPCRT4.dll+4a274|C:\Windows\System32\RPCRT4.dll+4918d|C:\Windows\System32\RPCRT4.dll+49a3b|C:\Windows\System32\RPCRT4.dll+310ac|C:\Windows\System32\RPCRT4.dll+3152c|C:\Windows\System32\RPCRT4.dll+1ae1c|C:\Windows\System32\RPCRT4.dll+1c67b|C:\Windows\System32\RPCRT4.dll+43a2a|C:\Windows\SYSTEM32\ntdll.dll+1d34e|